When you first install the app, four OAuth keys are needed to link your Splunk instance to both a Twitter account and an app owned by that Twitter account that is responsible for sending tweets on your behalf. To get these keys, make an app here.
Set up alerts with this app the same way you set up any other alert, making sure to choose the "Twitter" option for when the alert is triggered. Bear in mind that you can use fields from the alerting message (e.g. $result.user$ for the user field) to build your tweet.
Twitter does limit how often you can post to its API, so if you make too many attempts at once, you will be throttled by Twitter, and there's not a whole lot we can do about it. Also, bear in mind that tweets over 140 characters in length will automatically be truncated by the app before being sent to Twitter.
Add private messages
Add app icon
Change message from one-line input to textarea
Send a tweet when a custom alert is triggered
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.