Splunk Dev

How can I monitor my webhooks for failed webhooks that Splunk sends?

adrianbelen
New Member

In Splunk enterprise search, we can save the search query as alert and a corresponding action will be executed(webhook). I want to monitor failed webhook that Splunk enterprise sends. How can I do that? should I search index=_internal

0 Karma

stanhoener
Engager

For a simple list of all webhook activity:
index=_* webhook

_* - searches all internal logs
webhook - returns anything with webhook in _raw event

You could then narrow down your search with more specifics in the command line.. host=xxxxx.... etc.

0 Karma

harsmarvania57
Ultra Champion

Hi @adrianbelen,

You can cehck webhook alert action in splunk with query index=_internal sourcetype=splunkd component=sendmodalert action="webhook"

I hope this helps.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...