Use a webhook alert action
Webhooks allow you to define custom callbacks on a particular web resource. For instance, you can set up a webhook to make an alert message pop up in a chat room or post a notification on a web page. When an alert triggers, the webhook makes an HTTP POST request on the URL. The webhook passes JSON formatted information about the alert in the body of the POST request.
When you set up a webhook alert, you must get the hook URL from the target source. For example, if you want to post a webhook alert to a Slack room, you must follow Slack's webhook instructions to get the correct URL to use. You can test that webhooks are triggering by using a webhooks testing site such as https://webhook.site.
Webhook is part of the alert action workflow. The run_sendalert capability encapsulates the capability to run any alert and use the webhook action. The lowest default user role that has the run_sendalert capability is the user role.
For editing webhook allowlists, you need to use the edit_webhook_allow_list setting and have the admin role.
Webhook data payload
The webhook POST request's JSON data payload includes the following details.
- Search ID or SID for the saved search that triggered the alert
- Link to search results
- Search owner and app
- First result row from the triggering search results
Example
{ "result": { "sourcetype" : "mongod", "count" : "8" }, "sid" : "scheduler_admin_search_W2_at_14232356_132", "results_link" : "http://web.example.local:8000/app/search/@go?sid=scheduler_admin_search_W2_at_14232356_132", "search_name" : null, "owner" : "admin", "app" : "search" }
Depending on the webhook scenario, you can configure data payload handling on the resource receiving the POST.
Configure a webhook alert action
Set up a webhook when selecting alert actions for an alert.
- Follow one of these options to configure the webhook action when you create a new alert or edit an existing alert:
Option Steps Create a new alert From the Search page in the Search and Reporting app, select Save As > Alert. Enter alert details and configure triggering and throttling as needed. Edit an existing alert From the Alerts page in the Search and Reporting app, select Edit>Edit actions for an existing alert.
- In the Add Actions menu, select Webhook.
- Type a URL for the webhook.
- Click Save.
Use tokens in email notifications | Output results to a CSV lookup |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.0.1, 7.3.7, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 7.3.8
Feedback submitted, thanks!