Getting Data In

webhook: unable to read POST data

sistemistiposta
Path Finder

Hello Splunk users,
I'm sorry for this trivial question, but I can't understand.

How can I read the HTTP POST data from webhook alert action?

I wrote this webhook script:

<?php

file_put_contents('postalert', print_r($_POST, true));

?>

But when it triggers, I only see an empty array as result:

Array
(
)

I'm sad. Where am I wrong?

Thank you very much

Warm Regards
Marco

1 Solution

daxsmartpak
Engager

I was having the same issue and was able to find the answer with the following StackOverflow article, excerpted here:

The PHP superglobal $_POST is only is supposed to wrap data that is either

  • application/x-www-form-urlencoded (standard content type for simple form-posts) or
  • multipart/form-data-encoded (mostly used for file uploads)

You need to fetch it yourself in RAW format with:
file_get_contents('php://input')

https://stackoverflow.com/questions/8893574/php-php-input-vs-post

View solution in original post

0 Karma

daxsmartpak
Engager

I was having the same issue and was able to find the answer with the following StackOverflow article, excerpted here:

The PHP superglobal $_POST is only is supposed to wrap data that is either

  • application/x-www-form-urlencoded (standard content type for simple form-posts) or
  • multipart/form-data-encoded (mostly used for file uploads)

You need to fetch it yourself in RAW format with:
file_get_contents('php://input')

https://stackoverflow.com/questions/8893574/php-php-input-vs-post

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...