alerts

gowtham_94 · ‎10-13-2025

i want to update webhook url in "MS teams publish to channel" addon in splunk alerts using splunk REST api
using the below curl command but its not working

curl -k -u username:password "https://splunk.com/servicesNS/nobody/search/saved/searches/ADO_AgentPools_High%20Queued%20Jobs%20Cou..." -d "action.ms_teams_publish_to_channel=1" -d "action.ms_teams_publish_to_channel.param.alert_ms_teams_url=new_url" -d output_mode=json

gowtham_94 · ‎10-14-2025

Hi @livehybrid

i tried running this but its not working

command:
curl -k -u splunk-username:splunk-password "https://splunk-enterprise-url/servicesNS/nobody/tooling/saved/searches/ADO_AgentPools_High%20Queued%..." -d "actions=ms_teams_publish_to_channel" -d "action.ms_teams_publish_to_channel.param.alert_ms_teams_url=new_url" -d "output_mode=json"

response:
<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta http-equiv="refresh" content="1;url=https://splunk-enterprise-url/en-US/servicesNS/nobody/tooling/saved/searches/ADO_AgentPools_High%20Q..."><title>303 See Other</title></head><body><h1>See Other</h1><p>The resource has moved temporarily <a href="https://splunk-enterprise-url/en-US/servicesNS/nobody/tooling/saved/searches/ADO_AgentPools_High%20Q...">here</a>.</p></body></html>

livehybrid · ‎10-14-2025

Hi @gowtham_94

You look to be using the Splunk WebUI port rather than the REST / mgmt port (usually 8089).
Try using https://splunk-enterprise-url:8089/servicesNS/nobody/tooling/saved/searches/ADO_AgentPools_High%20Qu...

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

richgalloway · ‎10-13-2025

"Its not working" is not an actionable statement. What results error message do you get from that curl command? What other commands have you tried and how did they fail?

The URL appears to be incorrect. It should reference your Splunk environment rather than splunk.com.

If the KO being updated belongs to a specific app then that app should be specified in the URL. The current URL references the Search & Reporting app and so may not find the object in question.

---
If this reply helps you, Karma would be appreciated.

livehybrid · ‎10-13-2025

@richgalloway I ended up trying this myself as I have the add-on installed as the OP error description isnt much to go on. The response you get is a 200 status with the contents of the savedsearch configuration however the values dont change. This then reminded me of when Ive done something similar before where you need to set 'actions' to set the enabled actions rather than 'action.<actionName>=1' (see docs)

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

livehybrid · ‎10-13-2025

Hi @gowtham_94

You need to use "-d actions=ms_teams_publish_to_channel" such as:

curl -k -u username:password "https://splunk.com/servicesNS/nobody/search/saved/searches/ADO_AgentPools_High%20Queued%20Jobs%20Cou..." -d "actions=ms_teams_publish_to_channel" -d "action.ms_teams_publish_to_channel.param.alert_ms_teams_url=new_url" -d output_mode=json

"actions" should be A comma-separated list of actions to enable. For example: rss,email rather than using action.<action>=1

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

alerts

other

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

alerts

other

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future