I personally use the excellent RequestBin.com site to test all my config.
Endpoint = https://xxxxxxxxxxx.x.pipedream.net/
Query string params (optional) - Query string is commonly denoted keyvalues after a question mark. IE www.example.splunkcloud.com/en-GB/account/login?loginType=splunk. In this example loginType=splunk is a querystring.
Custom headers (optional) = These allow you to add custom headers. This is most commonly used for basic authentication.
Payload = If your search returns the fields Test & Source then you could specify source={source};test={test}. To send JSON in this version of the app. You must construct the JSON string in your SPL search
IE |eval json="{source:'".source."',test:'".test."'}"
and then reference that field
IE Payload = {json}
I admit this is clunky and would be hard to maintain for long JSON values; I'd suggest a purpose-built app if your JSON is complex or nested.
HTTP Method =POST
Ingest response to index = If you wish you ingest the response, specific the index here
Ingest Safety Max Size = This is the safety net to stop ingesting values greater than expected. If you don't want to ingest the response, set the value to 0
Should be able to identify errors with the following search. "index=_internal sourcetype=splunkd component=sendmodalert action="send_custom_rest_request"
... View more
