How to Develop and Deploy a Webhook Alert Action App with Custom Payload and Headers for Splunk
By: Ankit Tyagi
Tags: Webhooks, Adobe Engineering, API, Python, Splunk

How to Develop and Deploy a Webhook Alert Action App with Custom Payload and Headers for Splunk Ankit Tyagi Follow Jun 29 · 6 min read

Splunk is a wonderful tool with loads of features, yet a few of them are not available out-of-the-box — one of those missing features is the customizable webhook alert action.

While working on a project, I needed to send some custom metrics along with some headers from Splunk alerts and ended up exploring the default available webhook alert action.

Here’s what’s already available

Splunk, by default, provides webhook alert action for an alert; however, it is lacking some of the required features like:

Authentication mechanism

Custom header support

Custom payload support

With the above features being missing from the default webhook alert action on Splunk, it becomes much less useful because the webhooks mostly require some kind of authentication to receive the data and similarly, customized payload might be a requirement for some webhook APIs.

Splunk has done a great job with its pluggable platform, which allows you to write your own apps and deploy them to serve your custom requirements. Despite this, building a custom app can be tricky and time-consuming.

After reviewing the webhook alert action I decided to develop my own custom webhook alert action with all the required missing features.

customWebhook app to the rescue

I developed a customWebhook alert action application with the following configurable options:

URL: Target webhook URL

Headers (dict): Include any number of headers

e.g. {‘Authorization’: ‘Bearer <token>’, ‘Content-Type’: ‘application/json’…}

Payload (dict): Payload data with key-value pairs of your choice

e.g. {‘service_name’: ‘MyService’, ‘key1’: ‘value1’, ‘key2’: ‘value2’…}

I’ll walk you through easy and simple steps that would give you a kick start with your Splunk project.

Objectives:

1. Understand the Splunk app directory structure

2. Components with the respective directory structure

3. Configuration and logic code snippet

4. Deploy the application on the Splunk server

5. Create an alert with customWebhook alert action

Understand the Splunk app directory structure

A snapshot of the application directory structure.

Let’s break it down.

This is an exhaustive list of configuration I used in the customWebhook app, The complete list is here: https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/ModAlertsCreate

Configuration and logic code snippet

alert_actions.conf

# Configuration file path #$SPLUNK_HOME$/etc/apps/customWebhook_app/default/alert_actions.conf [customWebhook] is_custom = 1 label = customWebhook description = Send CustomWebhook alert notifications icon_path = customWebhook_icon.png payload_format = json param.alert_source = Splunk param.user_agent = Splunk/$server.guid$

app.conf

[ui] is_visible = 0 label = customWebhook alerts [launcher] author = Ankit Tyagi description = Send alert payload to custom webhook version = 1.0 [install] state = enabled is_configured = 1

restmap.conf

[validation:savedsearch] action.customWebhook = case('action.customWebhook' != "1", null(), 'action.customWebhook.param.base_url' == "action.customWebhook.param.base_url" OR 'action.customWebhook.param.base_url' == "", "No Webhook URL specified", 1==1, null()) action.customWebhook.param.base_url = validate( match('action.customWebhook.param.url', "^https?://[^\s]+$"), "Webhook URL is invalid")

default.meta

[alert_actions/customWebhook] export = system [alerts] export = system [restmap] export = system

customWebhook.html

<!--$SPLUNK_HOME$/etc/apps/customWebhook_app/default/data/ui/alerts/customWebhook.html-->



<form class="form-horizontal form-complex">

<div class="control-group">

<label class="control-label" for="customWebhook_base_url">URL</label>



<div class="controls">

<input type="text" class="input-xlarge" name="action.customWebhook.param.base_url" id="customWebhook_base_url" placeholder="https://server.com/api/v2/webhook/" />

<br>

<span class="help-block">

Webhook URL (str) https://server.com/api/v2/webhook

</span>

</div>

</div>

<div class="control-group">

<label class="control-label" for="customWebhook_headers">Headers</label>



<div class="controls">

<input type="text" name="action.customWebhook.param.headers" id="customWebhook_headers" placeholder="{'Content-Type': 'application/json', 'CustomHeader': 'Value'}"/>

<br>

<span class="help-block">

Headers (dict) <br>

e.g. {'Content-Type': 'application/json', 'CustomHeader': 'Value'}

</span>

</div>

</div>

<div class="control-group">

<label class="control-label" for="customWebhook_payload">Payload</label>



<div class="controls">

<input type="text" name="action.customWebhook.param.payload" id="customWebhook_payload" placeholder="{'key1': 'value1', 'key2': 'value2'}"/>

<br>

<span class="help-block">

Payload data (dict)

e.g. {'key1': 'value1', 'key2': 'value2'} <br>

add the key from seach result like this. <br>

e.g. {'key1': 'value1', 'key2': '$result.key_name$'}

</span>

</div>

</div>

</form>

alert_action.conf.spec

#$SPLUNK_HOME$/etc/apps/customWebhook_app/README/alert_actions.conf.spec [customWebhook] param.alert_source = "Splunk"

customWebhook.py