icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Slack Notification Alert
SHA256 checksum (slack-notification-alert_230.tgz) 41c9b12f4564ad6872582b2f314804f9d161cea72c5781c90844aebc684a1ed8 SHA256 checksum (slack-notification-alert_220.tgz) be1fcbf4241b920ec3af8bd493a3bcd1213c706921ff769a9416544467a600a6 SHA256 checksum (slack-notification-alert_213.tgz) 97c5bbdc9e0a382f10719ad92a6bf54c692d291240818f6a135f8c67df2b63f0 SHA256 checksum (slack-notification-alert_211.tgz) fcdcc19674bb47208ef16edb85d180d8ce0123dd0b0aa04c680f53d38e0a8719 SHA256 checksum (slack-notification-alert_210.tgz) 8652c27acc895389c141890b758c6cfbe7b337dbe6f5995c702adab3aeb8a9b4 SHA256 checksum (slack-notification-alert_203.tgz) 2461bcf9e9eab7853319ccdd71a82a38ea0057f98eccaf035bf25fd19a7ffb95 SHA256 checksum (slack-notification-alert_201.tgz) 8a291b093e4f55505dd60f6647175138a01a5f49e7c08d0de0fdb729fda8b0bb SHA256 checksum (slack-notification-alert_110.tgz) c2272ba6fbf4f504d4e4f4aecc766058cb324bd965b8ea448c73f44383d0f52b SHA256 checksum (slack-notification-alert_102.tgz) d4834c7fd76849535f520eab9070aa7471042083dac840f7052dfd5565476640 SHA256 checksum (slack-notification-alert_101.tgz) d8a868c49001dae9d3961140c5e6625fd4933c8efacee8b36fcb536fd71617b3
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

Slack Notification Alert

Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
Send a customized message to a Slack channel based on a triggered alert action in Splunk.

Leverages the custom alert action framework introduced in Splunk Enterprise v6.3. This alert extension framework enables full UI integration, management, dynamic parameter support, and more. This alert action was built as a reference example for the new custom alert action framework.

Note - This alert action integrates against the slack incoming webhook API
https://slack.com/apps/A0F7XDUAZ-incoming-webhooks

The source code for this app can be found on GitHub:

https://github.com/splunk/slack-alerts

Configuration

In order to setup the app, navigate to "Settings" -> "Alert actions". Click on "Setup Slack Alerts".

On the setup screen you'll want to supply a Webhook URL. You can obtain this URL by configuring a
custom integration for you Slack workspace.

For more information see https://slack.com/apps/A0F7XDUAZ-incoming-webhooks

Manually trigger the alert action

You can manually trigger the slack alert action if you want to verify the configuration and/or preview different parameter combinations.

For example:

| sendalert slack param.channel="#mychannel" param.message="Lorem ipsum"

Enter a simlar SPL query into the search bar in the search interface of Splunk to manually send a message.

Troubleshooting

Known issue with Setup

Setup page shows "I am Legend" setup_stub

An issue after upgrading the Slack Alerts app can cause an invalid redirect from the alert actions listing page to the setup page. Go to "Manage Apps" and click on "Set up" instead of using the Alert actions listing.

Alternatively - to fix it - you can remove the is_configured flag from $SPLUNK_HOME/etc/apps/slack_alerts/local/app.conf and restart Splunk.

Logs

In order to investigate problems with the Slack alert action, you can check the logs of the
alert action.

  • Navigate to "Settings" -> "Alert actions"
  • Click on "View log events" for the Slack alert action

You can also increase the verbosity of logs generated by the alert action by adjusting the

  • Navigate to "Settings" -> "Server settings" -> "Server logging"
  • Search for the log channel "sendmodalert"
  • Select logging level "DEBUG"

NOTE: This will increase cause detailed logs to be produced for all alert actions and might have an
impact on system performance. It is not recommended to do this on a production system.

Error Codes

In case of an error when manually triggering the Slack alert action, you'll notice an error code being returned (eg. Alert script returned error code 6.)

Here are the possible error codes returned by the slack alert action:

  • Error Code 2: Validation Failed

    This error code indications that the parameters handed to the alert action were invalid. Check the configuration.

  • Error Code 3: Channel not found

    This error code is returned if the given Slack channel was not found

  • Error Code 4: Forbidden

    Slack indicates that sending the message to the given channel is not allowed. Contact your Slack workspace administrator to find out about possible restrictions.

  • Error Code 5: HTTP failure

    This error code indicates a problem with executing the HTTP request to the configured webhook URL. Possible reasons include network issues, proxy server issues
    See logs for details.

  • Error Code 6: Unexpected error

    An unexpected error occurred while attempting to send the slack message.
    See logs for details.

Release Notes

Version 2.3.0
Dec. 10, 2022

Support for Slack Apps in addition to webhook URLs (thanks to bclarkejr 🙌)

Version 2.2.0
Dec. 11, 2020

Updated validation of channel names to allow for tokens to be used (eg. $result.myfield$)

Version 2.1.3
June 19, 2020
  • Fix for broken setup page
Version 2.1.1
June 16, 2020

New cloud compliant setup view

Version 2.1.0
June 15, 2020
  • Python 3 compatibility
  • New app icon
  • Cleanup of setup screen
Version 2.0.3
April 3, 2018
  • Updated app icon
  • Allow certain aspects of message attachment to be configured (conf file only for now)
Version 2.0.1
March 10, 2018
  • Added support for message attachments (see https://api.slack.com/docs/message-attachments)
  • Added support for showing a list of fields from the search results along with the slack message
  • Allows the user to override the webhook URL for each alert
  • Improved logging
Version 1.1.0
Nov. 16, 2017

Validating the webhook URL, forcing HTTPS.
Fixed sender icon.

Version 1.0.2
July 25, 2017

Fixed issue where the result link wouldn't get parsed correctly by the browser since it was being double encoded

Version 1.0.1
Sept. 10, 2015

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.