Test Webhook Functionality in Splunk Cloud.

Applicability

Description

This article helps to test the webhook functionality at Splunk Cloud Stack and confirm if a custom webhook URL is not working properly.

When configured an Alert to be sent to a custom webhook site. The Alert is working properly, being triggered under defined settings and e-mail notifications are received.

- The below query can be run at the Ad-Hoc Search Head ( Search and Reporting App) to find event messages related to the webhook action:

index="_internal" sendmodalert "action=webhook" NOT StreamedSearch

- The following event messages informs that there's an error detected when sending the configured webhook request:
 

ERROR sendmodalert - action=webhook STDERR - Error sending webhook request: <urlopen error [Errno 110] Connection timed out>

To test the functionalityof the webhook action at a Cloud Stack the next steps can be followed:

1. Sample Curl command. (Test it from the Splunk Cloud stack Search Head Command Line Interface  )

curl -k -v --header "Content-Type: application/json" --data '{"example":"xyz","testing":"abc"}' <webhook URL>

2. The Alert at Searches, Reports and Alerts can be cloned to replicate the issue.
Then with the Alert cloned in order to test the webhook functionality a custom webhook URL can be created (https://webhook.site/)  and replace the cloned webhook URL with the one created. And replicate the alert.
Wait for the webhook.site randomly generated URL to received the results from the alert to test the proper functionality.

Then, run the below query can be run at the Ad-Hoc Search Head ( Search and Reporting App) to find event messages related to the webhook action:

index="_internal" sendmodalert "action=webhook" NOT StreamedSearch

- The following event messages confirms that webhook is correctly working at the tested Cloud Stack when sending the configured webhook request: 
 

INFO sendmodalert - action=webhook - Alert action script completed in duration=1195 ms with exit code=0' AND 'Webhook receiver responded 
with HTTP status=200'

Related Links