Building for the Splunk Platform

How can I monitor my webhooks for failed webhooks that Splunk sends?

New Member

In Splunk enterprise search, we can save the search query as alert and a corresponding action will be executed(webhook). I want to monitor failed webhook that Splunk enterprise sends. How can I do that? should I search index=_internal

0 Karma


For a simple list of all webhook activity:
index=_* webhook

_* - searches all internal logs
webhook - returns anything with webhook in _raw event

You could then narrow down your search with more specifics in the command line.. host=xxxxx.... etc.

0 Karma


Hi @adrianbelen,

You can cehck webhook alert action in splunk with query index=_internal sourcetype=splunkd component=sendmodalert action="webhook"

I hope this helps.


0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...