Archive

webhook: unable to read POST data

Path Finder

Hello Splunk users,
I'm sorry for this trivial question, but I can't understand.

How can I read the HTTP POST data from webhook alert action?

I wrote this webhook script:

<?php

file_put_contents('postalert', print_r($_POST, true));

?>

But when it triggers, I only see an empty array as result:

Array
(
)

I'm sad. Where am I wrong?

Thank you very much

Warm Regards
Marco

1 Solution

Engager

I was having the same issue and was able to find the answer with the following StackOverflow article, excerpted here:

The PHP superglobal $_POST is only is supposed to wrap data that is either

  • application/x-www-form-urlencoded (standard content type for simple form-posts) or
  • multipart/form-data-encoded (mostly used for file uploads)

You need to fetch it yourself in RAW format with:
filegetcontents('php://input')

https://stackoverflow.com/questions/8893574/php-php-input-vs-post

View solution in original post

0 Karma

Engager

I was having the same issue and was able to find the answer with the following StackOverflow article, excerpted here:

The PHP superglobal $_POST is only is supposed to wrap data that is either

  • application/x-www-form-urlencoded (standard content type for simple form-posts) or
  • multipart/form-data-encoded (mostly used for file uploads)

You need to fetch it yourself in RAW format with:
filegetcontents('php://input')

https://stackoverflow.com/questions/8893574/php-php-input-vs-post

View solution in original post

0 Karma