Skip to content

Instantly share code, notes, and snippets.

@steadfasterX
Forked from ashishterp/slack_alert.py
Last active March 20, 2020 14:52
Show Gist options
  • Save steadfasterX/02736bccc1d32cd5c183e7880c9ca22c to your computer and use it in GitHub Desktop.
Save steadfasterX/02736bccc1d32cd5c183e7880c9ca22c to your computer and use it in GitHub Desktop.
Splunk Alerting to Slack
# Instructions:
# 1. Go to https://[yourdomain].slack.com/services/new
# 2. Configure a new Incoming WebHook and paste the URL below on Line 14
# 3. Copy this file into $SPLUNK_HOME$/bin/scripts
# 4. Configure your saved search to run slack_alert.py
from time import gmtime, strftime
import httplib, json
import getopt, sys, os
import subprocess
import gzip
def main():
WEBHOOK_URL = '<WEBHOOK URI FROM SLACK APP>'
headers = {'Content-Type': 'application/json'}
text = 'Splunk Alert'
color = 'good'
f = gzip.open(sys.argv[8], 'rb')
csv_content=f.read()
current_time = strftime("%Y-%m-%d %H:%M:%S", gmtime())
pretext = '*%s - %s:*' % (current_time, sys.argv[4])
posttext = '<%s|Click here> for more details.' % sys.argv[6]
message = {
'text': pretext + '\n' + csv_content + posttext,
'username': 'Splunk',
'fallback': text,
'color': color,
'fields': [
{
'title': "Events",
'value': sys.argv[1],
'short': True
}
]
}
connection = httplib.HTTPSConnection('hooks.slack.com')
connection.request('POST', WEBHOOK_URL, json.dumps(message), headers)
print json.dumps(message)
response = connection.getresponse()
print response.read().decode()
if __name__ == '__main__':
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment