Splunk Dev

How can I monitor my webhooks for failed webhooks that Splunk sends?

adrianbelen
New Member

In Splunk enterprise search, we can save the search query as alert and a corresponding action will be executed(webhook). I want to monitor failed webhook that Splunk enterprise sends. How can I do that? should I search index=_internal

0 Karma

stanhoener
Engager

For a simple list of all webhook activity:
index=_* webhook

_* - searches all internal logs
webhook - returns anything with webhook in _raw event

You could then narrow down your search with more specifics in the command line.. host=xxxxx.... etc.

0 Karma

harsmarvania57
Ultra Champion

Hi @adrianbelen,

You can cehck webhook alert action in splunk with query index=_internal sourcetype=splunkd component=sendmodalert action="webhook"

I hope this helps.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...