Splunk Add-on - multi select values in an alert action

[shacharh]

Hi,

I'm working on an add-on for Splunk. I added an alert action, and I'm adding some fields to it.
How can I add a dynamic multi-select field? The use case - I query Splunk, display the values, and allow the user to select some or all of them. The closest thing I've found is Splunk's splunk-search-dropdown, but it is only for single select.

Thanks,
Shachar

[lakshman239]

would it be of any issue, if you concatenate the multiple values selected by user to something like "value1, value2,value3" and send it your alert actions, where you can act based on value1, 2 3?

[shacharh]

@lakshman239 If you mean that the user would be able to select multiple values, and I'll get them as "value1, value2,value3" in the backend, yes, that would work for me.

[lakshman239]

when user selects multiple values, save them to a field in an index (which has concatenated values) and give this in your alert action [ one of the field].

[shacharh]

But I need to dynamically create those fields from a search results. Is this possible?

[lakshman239]

Yes, thats possible. As you know what fields are possible (by dynamic selection), you can save them to a field and inside the modalert*.py, you can parse them and extract them to your needs.

[shacharh]

@lakshman239 but how can the user choose the fields? (he needs to choose some or all of them)

[lakshman239]

As part of your add-on, I assume you are building a config page and alert UI (where you run a search and show fields in multi-select). The users select them and you save them to another field or index, which is passed as alert actions (pls check alert_actions.conf) and inside your modalert*.py you can then process them. Hope I am thinking along your requirements. If you are using Add-on builder, it will be easy.