Start small, send a message from Slack to the Splunk user. The Slack permissions are a bit of a pig. I believe there was a call back that you had to do the first time - sort of a 2 step authentication. Start by taking Splunk out of the equation and use postman to test it (It has a faster turn around). Its been a while but I think that the Slack was more flexible if done as a REST API   ... View more

The Splunk account needs to be the Super (World?) admin(Highest level) otherwise it can only read its own messages. Alternatively, it can be a member of a group. A bit of a pain really. ... View more

OK, I finally worked this out. 1) Copy sendemail.py in $SPLUNK_HOME/etc/apps/search/bin to sendemailcustom.py (NOTE if you name it sendemail_custom.py Splunkwill find sendemail first, so best practice is not to use underscores in the name) 2) edit line #336 as in the answer above if argvals.get('attachment_name'): ssContent['action.email.reportFileName'] = argvals.get('attachment_name') 3) in $SPLUNK_HOME/etc/apps/search/local/commands.conf add: [sendemailcustom] filename = sendemailcustom.py streaming = false run_in_preview = false passauth = true required_fields = changes_colorder = false supports_rawargs = true undo_scheduler_escaping = true is_risky = true supports_multivalues = true 4) to make the command line format nicely, go to $SPLUNK_HOME/etc/system/default/searchbnf.conf and copy the sendemail section with all the parameters to $SPLUNK_HOME/etc/system/local/searchbnf.conf 5) change references to sendemail to sendemailcustom 6) add the following: [attachment_name-option] syntax = attachment_name= description = The filename of the attachment. Save the file and restart Splunk. Presto a custom sendemail command with help, prompts and an option for a filename ... View more

The documentation states that you need the following scopes: admin channel.history In fact you also need: channels:read users:read team:read To test what is going on, you need postman (The app error messages are as good as the documentation) Test the api calls listed in slack_messages.py and slack_logins.py (look for api_call) . Then get the examples from https://api.slack.com/methods and your are set. "Other that that Mrs. Lincoln, how did you enjoy the play" ... View more

Edit slack_webhook_alert.py Replace the last line with : try: json_object = json.loads(slack_message) requests.post(slack_webhook, data=slack_message) except ValueError, e: requests.post(slack_webhook, data=json.dumps({'text': slack_message})) This will allow you to send the message as JSON ... View more

I found it. In Carbon Black, the api key has its own whitelist. You have to have the Splunk server ip whitelisted in Carbon Black for the key to work. ... View more

Hmm, "read the documentation", very helpful. ... View more