All Apps and Add-ons

Slack Notification Alert: How can I get the message to use the resulting value from a saved search?

geonspapa
Explorer

I am using the Slack Notification Alert app.
My saved search alert is set for Slack.

I want to send a message using the resulting value.

How can I replace it?

1 Solution

rfujara_splunk
Splunk Employee
Splunk Employee

Hi geonspapa,

using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:

$result.my_field_name$

... where "my_field_name" is the name if a field in the search result.

Please have a look at the attached screenshot.

slack_alert_action

Regards,
Robert

View solution in original post

russellliss
Path Finder

Try changing the trigger action to "For each result" to get more than the first row.

akchauhan
Explorer

is there any other way to get all events? By selection "For each result" i am getting all messages but it results in large number of messages on slack channel ie. will get 10 messages on slack channel for 10 events. I am looking to get only one slack message containing all 10 events.

rfujara_splunk
Splunk Employee
Splunk Employee

Hi geonspapa,

using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:

$result.my_field_name$

... where "my_field_name" is the name if a field in the search result.

Please have a look at the attached screenshot.

slack_alert_action

Regards,
Robert

bandit
Motivator

Is there a way to encapsulate fields that have spaces and pass to slack? I have several canned DMC alerts I'm working on sending over to slack. Just trying to figure out of I need to get rid of the rename statements which added spaces to the field names.

example:
| rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

0 Karma

joshualarkins
Explorer

I gave up trying to pass field names with spaces and just removed my rename line that was giving me friendly names.

0 Karma

bandit
Motivator

Is it possible to pass multiple results records?

As an example:

search:
index=* | head 100 | stats count by host sourcetype source

I put this in my slack alert but I only see one record:
$result.host$ $result.sourcetype$ $result.source$ $result.count$

0 Karma

joshualarkins
Explorer

See @russellliss 's answer.

0 Karma

rajuljain2605
Explorer

Did you get solution for it? I had stuck at same place.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...