Outgoing Webhook Payload Variables in Splunk On-Call

Applicability

Description

Splunk On-Call allows to integrate with external tools of your choice through custom outbound webhooks. These webhooks are highly flexible, providing full control over the URL, HTTP method, content type, and payload structure. To ensure that the data sent to third-party systems is relevant and real-time, dynamic variables can be incorporated. These variables are categorized by event types—such as Incident, Chat, or Paging and must be enclosed in the ${{VARIABLE_NAME}} syntax. For example, to include the total number of alerts within an incident,  ${{STATE.ALERT_COUNT}} variable should be used.  

Investigation

Dynamic variables within webhook payloads allows to ensure third-party systems receive real-time, context-specific information. Please note that the available variables change depending on the Event Type selected during configuration. To correctly reference a variable, use the ${{variable_name}} syntax. For example, to pass the total number of alerts in an incident, you would use ${{STATE.ALERT_COUNT}}.

Resolution

Built-in variables allow alerting platform to dynamically pass incident data to external or third-party systems. The variables used in the payload depend on the specific event type chosen for the webhook.

Variables by Event Type 

Payload Construction:
When including variables in the payload, wrap them with ${{variable_name}}. For example, to include the number of alerts in an incident, use ${{STATE.ALERT_COUNT}}. Other incident-specific fields such as ${{ALERT.field_name}} can also be used.