Hi
I am trying to send an alert to Telegram from Splunk using the default webhooks as the Telegram alert action is no longer supported (https://splunkbase.splunk.com/app/4917).
Has anyone managed to get it working, there is no documentation on the Splunk site on using the webhook.
I am using the string below that works in a browser, but not in Splunk, so not sure how to format the string.
https://api.telegram.org/bot#########/sendMessage?chat_id=-########&text=test
Thanks
Hi @Raees
As previously mentioned, the Splunk inbuilt webhooks use a POST with a pretty non-configurable output.
You can use https://splunkbase.splunk.com/app/7450 which allows much more customisation.
Here is a working example.
I installed the app and created an alert action as below:
Put url as: https://api.telegram.org/bot<yourToken>/sendMessage
Payload:
{
"chat_id":"<yourChatID>",
"text": "$result.msg$"
}
This will send the value of the "msg" field from Splunk search, obviously you can update this and use more fields if required too.
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will
Configure the webhook with the following details:
URL: https://api.telegram.org/bot<YourBotToken>/sendMessage
HTTP Method: POST
Request Payload:
{
"chat_id": "<YourChatID>",
"text": "Alert: $result.message$"
}
Trigger Conditions: Set the conditions under which the alert should trigger.
Test the Webhook: Save the alert and test it to ensure that messages are being sent to your Telegram chat.
Here’s an example of how the webhook URL and payload might look:
{
"url": "https://api.telegram.org/bot123456789:ABCdefGHIjklMNOpqrSTUvwXYZ/sendMessage",
"method": "POST",
"payload": {
"chat_id": "-987654321",
"text": "Alert: $result.message$"
}
}
Make sure to replace <YourBotToken> and <YourChatID> with your actual bot token and chat ID.
Thanks for the POST details, I don't see how all the info is supposed to be entered as there is only a field for the URL
Please check this
https://docs.splunk.com/Documentation/Splunk/9.4.0/Alert/Webhooks
@kiran_panchavat Thank you, this helps, will look up how to send a POST request to Telegram
Hi @Raees
Unfortunately the Inbuilt webhook POST sends a payload as below, which isnt possible to change the format of.
{
"result": {
"sourcetype" : "mongod",
"count" : "8"
},
"sid" : "scheduler_admin_search_W2_at_14232356_132",
"results_link" : "http://web.example.local:8000/app/search/@go?sid=scheduler_admin_search_W2_at_14232356_132",
"search_name" : null,
"owner" : "admin",
"app" : "search"
}
I think this should be achievable with the https://splunkbase.splunk.com/app/4146 app - although possibly not as an alert action, but could be achieved by adding the necessary commands on the end of your SPL.
I will see if I can work together an example
PLease let me know if this helped by adding karma and/or accepting as an answer if this resolves the issue for you.
Sure, Please check.
https://api.telegram.org/bot<your-bot-token>/sendMessage
{ "chat_id": "-########", "text": "Alert from Splunk: $result.message$" }
NOTE:-
{ "chat_id": "-123456789", "text": "Splunk Alert: $result.host$ triggered an event at $trigger_time$" }