Splunk Enterprise Security

Splunk Add-on - multi select values in an alert action

shacharh
New Member

Hi,

I'm working on an add-on for Splunk. I added an alert action, and I'm adding some fields to it.
How can I add a dynamic multi-select field? The use case - I query Splunk, display the values, and allow the user to select some or all of them. The closest thing I've found is Splunk's splunk-search-dropdown, but it is only for single select.

Thanks,
Shachar

0 Karma

lakshman239
Influencer

would it be of any issue, if you concatenate the multiple values selected by user to something like "value1, value2,value3" and send it your alert actions, where you can act based on value1, 2 3?

0 Karma

shacharh
New Member

@lakshman239 If you mean that the user would be able to select multiple values, and I'll get them as "value1, value2,value3" in the backend, yes, that would work for me.

0 Karma

lakshman239
Influencer

when user selects multiple values, save them to a field in an index (which has concatenated values) and give this in your alert action [ one of the field].

0 Karma

shacharh
New Member

But I need to dynamically create those fields from a search results. Is this possible?

0 Karma

lakshman239
Influencer

Yes, thats possible. As you know what fields are possible (by dynamic selection), you can save them to a field and inside the modalert*.py, you can parse them and extract them to your needs.

0 Karma

shacharh
New Member

@lakshman239 but how can the user choose the fields? (he needs to choose some or all of them)

0 Karma

lakshman239
Influencer

As part of your add-on, I assume you are building a config page and alert UI (where you run a search and show fields in multi-select). The users select them and you save them to another field or index, which is passed as alert actions (pls check alert_actions.conf) and inside your modalert*.py you can then process them. Hope I am thinking along your requirements. If you are using Add-on builder, it will be easy.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...