Slack alert not sending?

[nick405060]

Hi guys,

I have four Slack alerts that are not sending to their specified channels, but other of my Slack alerts are working. Why would this be?

[dajomas]

@nick405060 Hi there,

unfortunately, I haven't been working with Splunk a lot and to my shame, the Slack alert app has been slipping a bit.

I will have to dig into the reason why I had the message field mandatory and if that's the case, why it doesn't warn when it is actually empty.

Might well be a bug. But I can't say right now.

I will keep you posted.

Best regards,
Johan

[nick405060]

One other issue: the specified whitespace " " to fix this issue gets wiped on reboot. So the integrations get disabled upon reboot

[nick405060]

(hacky) workaround https://answers.splunk.com/answers/762614/is-it-possible-to-escape-whitespace-in-savedsearch.html

[nick405060 · Accepted solution]

Your message field cannot be empty. You must specify " " or put some other value in there for a message. This is either 1) a bug or 2) intended functionality, which makes no sense, because EVERY other Slack integration besides Splunk just lets you pump the data out directly. If 2) is indeed the case, and for some bizarre reason this is intended functionality, there should at least be an error message instead of just letting you save the alert which will be secretly not working.