Splunk On-Call

How to get custom alert fields, or just alert.raw on custom outgoing webhook? (Any-Incident event type)?

whyNot
Engager

hi, we have a bunch of fields that show up in the Splunk Oncall/VictorOps UI. under either "Alert Details > Alert Data > Alert Fields" or "Annotations" (screenshot below) that i'm hoping to insert into the payload body of a custom outbound webhook  of "Any-Incident" event type.

When using the VictorOps API i only see the custom fields present under the "raw" field of the GET Alert response.

I see in the Incident Fields support page some mention of custom_fields, which makes me think perhaps we could add those to payload with something like ${{ALERT.custom_fields}}, or ${{ALERT.raw}}, but at least when i tried those nothing was populated on the webhook payload for it

Since i havent been able to find documentation on how to add these custom fields, annotations, or raw alert payload to the webhook payload body and they dont appear within the suggested variables, does someone know how we would add those to the webhook body or if thats possible?  Or do i need to pull them from the Alert.raw field myself and if so how would i get that raw field on the webhook payload?

 

Thanks!

"Screenshot 2023-04-02 at 3.30.52 PM.png

Labels (3)
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...