Alerting

how to post splunk alert severity to webhook url

srinivasup
Explorer

hi,

I have configured an alert to run for every 5 minz and it will post the results to webhook url, when i see that json payload, im not able to find severity ,

How can i include alert severity in json automatically

Tags (1)
0 Karma

woodcock
Esteemed Legend

This is arbitrary and selected by you! You get to create the search and then you get to decide the severity that it should have when you save it as an Alert.

0 Karma

srinivasup
Explorer

yeah thats fine but for each alert we configure, we have an option to choose severity, so we want to see that in payload.

0 Karma

woodcock
Esteemed Legend

The severity assigned is visible in the Alert, which is an event that you can view by going to Activity -> Triggered Alerts. You can also view the severity in searches like this:

index="_audit" action="alert_fired"

And this:

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*"
0 Karma

woodcock
Esteemed Legend

We need more information. What is your search string? What does your raw data look like?

0 Karma

srinivasup
Explorer

I have create an alert with below query

index=_internal | table host _time

This is my query alert and it will be triggered for every 5minz, and it is posting data to webhook, and im able to see json payload but when we configure alert we can choose alert severity or priority, this values is not included in JSON payload, we want to know how to include this .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...