[{"data":1,"prerenderedAt":662},["ShallowReactive",2],{"content-query-K26cy36R5f":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"layout":10,"author":11,"tags":12,"categories":17,"date":19,"faq":20,"image":33,"body":34,"_type":655,"_id":656,"_source":657,"_file":658,"_stem":659,"_extension":660,"sitemap":661},"/blog/splunk-webhook-alerts","blog",false,"","Splunk Webhook Alerts: Payload, Limits and Fan-Out","Wire Splunk alert actions to webhooks: the exact JSON payload Splunk sends, the webhook action's limitations (no custom headers), URL allowlisting in Splunk Cloud, and how to fan alerts out to Slack, PagerDuty or anywhere else.","post","Karolis Rusenas",[13,14,15,16],"splunk","webhooks","alerting","observability",[18],"tutorials","2026-07-07 12:30:00",[21,24,27,30],{"q":22,"a":23},"What does a Splunk webhook alert payload contain?","A JSON object with sid (the search job id), search_name, app, owner, results_link (a URL back into Splunk) and a result object holding the first result row's fields. It is POSTed with content type application/json from user agent Splunk/\u003Cuuid>.",{"q":25,"a":26},"Can Splunk webhooks send custom headers or authentication?","No — the built-in webhook alert action sends a fixed POST with no custom headers, no auth and no body templating. If your receiver needs an Authorization header or a different JSON shape, put a relay/transformer in between, or install a custom alert action app.",{"q":28,"a":29},"Why does my Splunk Cloud webhook fail to send?","Splunk Cloud only delivers webhooks to URLs on the deployment's allowlist. An admin must add your endpoint's domain under Server settings → Webhook allow list. On-prem Splunk Enterprise has no such restriction by default.",{"q":31,"a":32},"How do I send a Splunk alert to Slack or Teams?","Slack and Teams expect their own JSON shapes, which Splunk's webhook action cannot produce. Point the alert at a relay endpoint and transform the payload in flight into the target format — or use the marketplace Slack app for Splunk if you only ever need Slack.","/images/blog/heroes/route.jpg",{"type":35,"children":36,"toc":648},"root",[37,47,61,68,80,114,120,134,386,391,456,462,475,487,561,567,600,606,642],{"type":38,"tag":39,"props":40,"children":41},"element","p",{},[42],{"type":38,"tag":43,"props":44,"children":46},"img",{"alt":45,"src":33},"Splunk webhook alerts",[],{"type":38,"tag":39,"props":48,"children":49},{},[50,53,59],{"type":51,"value":52},"text","Splunk's ",{"type":38,"tag":54,"props":55,"children":56},"strong",{},[57],{"type":51,"value":58},"webhook alert action",{"type":51,"value":60}," is the quickest way to get a saved-search alert out of Splunk and into your own systems — and also one of the most restrictive webhook senders you will meet: fixed payload, no custom headers, no retries to speak of. This guide shows exactly what it sends (from real captured traffic), the constraints, and the patterns that turn one Splunk alert into properly formatted notifications anywhere.",{"type":38,"tag":62,"props":63,"children":65},"h2",{"id":64},"setting-it-up",[66],{"type":51,"value":67},"Setting it up",{"type":38,"tag":39,"props":69,"children":70},{},[71,73,78],{"type":51,"value":72},"On a saved search: ",{"type":38,"tag":54,"props":74,"children":75},{},[76],{"type":51,"value":77},"Save As → Alert → Trigger Actions → Add Actions → Webhook",{"type":51,"value":79},", then paste the target URL. That is the whole configuration surface — one URL field. Every time the alert triggers, Splunk POSTs JSON to it.",{"type":38,"tag":39,"props":81,"children":82},{},[83,88,90,95,97,104,106,112],{"type":38,"tag":54,"props":84,"children":85},{},[86],{"type":51,"value":87},"Splunk Cloud gotcha:",{"type":51,"value":89}," deliveries only go to allowlisted destinations. An admin adds your endpoint under ",{"type":38,"tag":54,"props":91,"children":92},{},[93],{"type":51,"value":94},"Server settings → Webhook allow list",{"type":51,"value":96}," first; otherwise the action silently fails (check ",{"type":38,"tag":98,"props":99,"children":101},"code",{"className":100},[],[102],{"type":51,"value":103},"python.log",{"type":51,"value":105},"/",{"type":38,"tag":98,"props":107,"children":109},{"className":108},[],[110],{"type":51,"value":111},"webhook",{"type":51,"value":113}," logs).",{"type":38,"tag":62,"props":115,"children":117},{"id":116},"the-payload",[118],{"type":51,"value":119},"The payload",{"type":38,"tag":39,"props":121,"children":122},{},[123,125,132],{"type":51,"value":124},"This is what actually arrives (shape captured on our public ",{"type":38,"tag":126,"props":127,"children":129},"a",{"href":128},"/webhook-bin",[130],{"type":51,"value":131},"webhook bin",{"type":51,"value":133},"; values fictionalized):",{"type":38,"tag":135,"props":136,"children":140},"pre",{"className":137,"code":138,"language":139,"meta":7,"style":7},"language-json shiki shiki-themes github-dark","{\n  \"sid\": \"scheduler__search__RMD5example_at_1768472000_100\",\n  \"search_name\": \"High error rate on checkout service\",\n  \"app\": \"search\",\n  \"owner\": \"alerts\",\n  \"results_link\": \"https://splunk.example.com:8000/app/search/search?q=%7Cloadjob%20…\",\n  \"result\": {\n    \"host\": \"web-03.example.internal\",\n    \"source\": \"/var/log/app/error.log\",\n    \"count\": \"147\",\n    \"status_text\": \"error rate above threshold\"\n  }\n}\n","json",[141],{"type":38,"tag":98,"props":142,"children":143},{"__ignoreMap":7},[144,156,182,204,226,248,270,284,306,328,350,368,377],{"type":38,"tag":145,"props":146,"children":149},"span",{"class":147,"line":148},"line",1,[150],{"type":38,"tag":145,"props":151,"children":153},{"style":152},"--shiki-default:#E1E4E8",[154],{"type":51,"value":155},"{\n",{"type":38,"tag":145,"props":157,"children":159},{"class":147,"line":158},2,[160,166,171,177],{"type":38,"tag":145,"props":161,"children":163},{"style":162},"--shiki-default:#79B8FF",[164],{"type":51,"value":165},"  \"sid\"",{"type":38,"tag":145,"props":167,"children":168},{"style":152},[169],{"type":51,"value":170},": ",{"type":38,"tag":145,"props":172,"children":174},{"style":173},"--shiki-default:#9ECBFF",[175],{"type":51,"value":176},"\"scheduler__search__RMD5example_at_1768472000_100\"",{"type":38,"tag":145,"props":178,"children":179},{"style":152},[180],{"type":51,"value":181},",\n",{"type":38,"tag":145,"props":183,"children":185},{"class":147,"line":184},3,[186,191,195,200],{"type":38,"tag":145,"props":187,"children":188},{"style":162},[189],{"type":51,"value":190},"  \"search_name\"",{"type":38,"tag":145,"props":192,"children":193},{"style":152},[194],{"type":51,"value":170},{"type":38,"tag":145,"props":196,"children":197},{"style":173},[198],{"type":51,"value":199},"\"High error rate on checkout service\"",{"type":38,"tag":145,"props":201,"children":202},{"style":152},[203],{"type":51,"value":181},{"type":38,"tag":145,"props":205,"children":207},{"class":147,"line":206},4,[208,213,217,222],{"type":38,"tag":145,"props":209,"children":210},{"style":162},[211],{"type":51,"value":212},"  \"app\"",{"type":38,"tag":145,"props":214,"children":215},{"style":152},[216],{"type":51,"value":170},{"type":38,"tag":145,"props":218,"children":219},{"style":173},[220],{"type":51,"value":221},"\"search\"",{"type":38,"tag":145,"props":223,"children":224},{"style":152},[225],{"type":51,"value":181},{"type":38,"tag":145,"props":227,"children":229},{"class":147,"line":228},5,[230,235,239,244],{"type":38,"tag":145,"props":231,"children":232},{"style":162},[233],{"type":51,"value":234},"  \"owner\"",{"type":38,"tag":145,"props":236,"children":237},{"style":152},[238],{"type":51,"value":170},{"type":38,"tag":145,"props":240,"children":241},{"style":173},[242],{"type":51,"value":243},"\"alerts\"",{"type":38,"tag":145,"props":245,"children":246},{"style":152},[247],{"type":51,"value":181},{"type":38,"tag":145,"props":249,"children":251},{"class":147,"line":250},6,[252,257,261,266],{"type":38,"tag":145,"props":253,"children":254},{"style":162},[255],{"type":51,"value":256},"  \"results_link\"",{"type":38,"tag":145,"props":258,"children":259},{"style":152},[260],{"type":51,"value":170},{"type":38,"tag":145,"props":262,"children":263},{"style":173},[264],{"type":51,"value":265},"\"https://splunk.example.com:8000/app/search/search?q=%7Cloadjob%20…\"",{"type":38,"tag":145,"props":267,"children":268},{"style":152},[269],{"type":51,"value":181},{"type":38,"tag":145,"props":271,"children":273},{"class":147,"line":272},7,[274,279],{"type":38,"tag":145,"props":275,"children":276},{"style":162},[277],{"type":51,"value":278},"  \"result\"",{"type":38,"tag":145,"props":280,"children":281},{"style":152},[282],{"type":51,"value":283},": {\n",{"type":38,"tag":145,"props":285,"children":287},{"class":147,"line":286},8,[288,293,297,302],{"type":38,"tag":145,"props":289,"children":290},{"style":162},[291],{"type":51,"value":292},"    \"host\"",{"type":38,"tag":145,"props":294,"children":295},{"style":152},[296],{"type":51,"value":170},{"type":38,"tag":145,"props":298,"children":299},{"style":173},[300],{"type":51,"value":301},"\"web-03.example.internal\"",{"type":38,"tag":145,"props":303,"children":304},{"style":152},[305],{"type":51,"value":181},{"type":38,"tag":145,"props":307,"children":309},{"class":147,"line":308},9,[310,315,319,324],{"type":38,"tag":145,"props":311,"children":312},{"style":162},[313],{"type":51,"value":314},"    \"source\"",{"type":38,"tag":145,"props":316,"children":317},{"style":152},[318],{"type":51,"value":170},{"type":38,"tag":145,"props":320,"children":321},{"style":173},[322],{"type":51,"value":323},"\"/var/log/app/error.log\"",{"type":38,"tag":145,"props":325,"children":326},{"style":152},[327],{"type":51,"value":181},{"type":38,"tag":145,"props":329,"children":331},{"class":147,"line":330},10,[332,337,341,346],{"type":38,"tag":145,"props":333,"children":334},{"style":162},[335],{"type":51,"value":336},"    \"count\"",{"type":38,"tag":145,"props":338,"children":339},{"style":152},[340],{"type":51,"value":170},{"type":38,"tag":145,"props":342,"children":343},{"style":173},[344],{"type":51,"value":345},"\"147\"",{"type":38,"tag":145,"props":347,"children":348},{"style":152},[349],{"type":51,"value":181},{"type":38,"tag":145,"props":351,"children":353},{"class":147,"line":352},11,[354,359,363],{"type":38,"tag":145,"props":355,"children":356},{"style":162},[357],{"type":51,"value":358},"    \"status_text\"",{"type":38,"tag":145,"props":360,"children":361},{"style":152},[362],{"type":51,"value":170},{"type":38,"tag":145,"props":364,"children":365},{"style":173},[366],{"type":51,"value":367},"\"error rate above threshold\"\n",{"type":38,"tag":145,"props":369,"children":371},{"class":147,"line":370},12,[372],{"type":38,"tag":145,"props":373,"children":374},{"style":152},[375],{"type":51,"value":376},"  }\n",{"type":38,"tag":145,"props":378,"children":380},{"class":147,"line":379},13,[381],{"type":38,"tag":145,"props":382,"children":383},{"style":152},[384],{"type":51,"value":385},"}\n",{"type":38,"tag":39,"props":387,"children":388},{},[389],{"type":51,"value":390},"Key facts:",{"type":38,"tag":392,"props":393,"children":394},"ul",{},[395,420,441,451],{"type":38,"tag":396,"props":397,"children":398},"li",{},[399,410,412,418],{"type":38,"tag":54,"props":400,"children":401},{},[402,408],{"type":38,"tag":98,"props":403,"children":405},{"className":404},[],[406],{"type":51,"value":407},"result",{"type":51,"value":409}," holds only the first row",{"type":51,"value":411}," of the alert's search results, fields as strings. If you need all rows, have the receiver follow ",{"type":38,"tag":98,"props":413,"children":415},{"className":414},[],[416],{"type":51,"value":417},"results_link",{"type":51,"value":419}," back into Splunk's API, or restructure the search so row one carries what you need.",{"type":38,"tag":396,"props":421,"children":422},{},[423,425,431,433,439],{"type":51,"value":424},"The request comes from user agent ",{"type":38,"tag":98,"props":426,"children":428},{"className":427},[],[429],{"type":51,"value":430},"Splunk/\u003Cinstance-uuid>",{"type":51,"value":432}," with ",{"type":38,"tag":98,"props":434,"children":436},{"className":435},[],[437],{"type":51,"value":438},"Content-Type: application/json",{"type":51,"value":440},".",{"type":38,"tag":396,"props":442,"children":443},{},[444,449],{"type":38,"tag":54,"props":445,"children":446},{},[447],{"type":51,"value":448},"There is no signature and no auth header.",{"type":51,"value":450}," Anyone who learns the URL can POST fake alerts, so treat the URL as a secret (path token) and/or validate the source IP.",{"type":38,"tag":396,"props":452,"children":453},{},[454],{"type":51,"value":455},"The bin's sample catalog includes this exact event shape — one click sends a realistic Splunk alert at your handler while you develop.",{"type":38,"tag":62,"props":457,"children":459},{"id":458},"the-limitations-and-the-pattern-around-them",[460],{"type":51,"value":461},"The limitations — and the pattern around them",{"type":38,"tag":39,"props":463,"children":464},{},[465,467,473],{"type":51,"value":466},"The webhook action cannot: set headers, template the body, sign requests, or reshape JSON. Meanwhile real destinations want exactly those things — Slack wants ",{"type":38,"tag":98,"props":468,"children":470},{"className":469},[],[471],{"type":51,"value":472},"{\"text\": …}",{"type":51,"value":474},", PagerDuty wants its Events API format, your internal gateway wants a bearer token.",{"type":38,"tag":39,"props":476,"children":477},{},[478,480,485],{"type":51,"value":479},"The clean solution is a ",{"type":38,"tag":54,"props":481,"children":482},{},[483],{"type":51,"value":484},"relay in the middle",{"type":51,"value":486},". Point Splunk's one URL field at a stable Webhook Relay endpoint, then:",{"type":38,"tag":392,"props":488,"children":489},{},[490,508,526,543],{"type":38,"tag":396,"props":491,"children":492},{},[493,498,500,506],{"type":38,"tag":54,"props":494,"children":495},{},[496],{"type":51,"value":497},"Transform in flight",{"type":51,"value":499}," — a small JavaScript ",{"type":38,"tag":126,"props":501,"children":503},{"href":502},"/features/transform-webhooks",[504],{"type":51,"value":505},"transformation function",{"type":51,"value":507}," reshapes Splunk's payload into the Slack/Teams/PagerDuty format and sets any headers your destination needs.",{"type":38,"tag":396,"props":509,"children":510},{},[511,516,518,524],{"type":38,"tag":54,"props":512,"children":513},{},[514],{"type":51,"value":515},"Fan out",{"type":51,"value":517}," — deliver one alert to ",{"type":38,"tag":126,"props":519,"children":521},{"href":520},"/features/webhook-multiple-destinations",[522],{"type":51,"value":523},"multiple destinations",{"type":51,"value":525}," at once: the on-call channel, the incident tool, and a data sink.",{"type":38,"tag":396,"props":527,"children":528},{},[529,534,536,542],{"type":38,"tag":54,"props":530,"children":531},{},[532],{"type":51,"value":533},"Reach internal systems",{"type":51,"value":535}," — if the real consumer sits in a private network, the relay agent forwards alerts inside without opening firewall ports, the same pattern as ",{"type":38,"tag":126,"props":537,"children":539},{"href":538},"/blog/how-to-test-webhooks",[540],{"type":51,"value":541},"receiving webhooks on localhost",{"type":51,"value":440},{"type":38,"tag":396,"props":544,"children":545},{},[546,551,553,559],{"type":38,"tag":54,"props":547,"children":548},{},[549],{"type":51,"value":550},"Add reliability Splunk lacks",{"type":51,"value":552}," — deliveries are stored and ",{"type":38,"tag":126,"props":554,"children":556},{"href":555},"/features/durable-retries",[557],{"type":51,"value":558},"retried towards your destination for up to 30 days",{"type":51,"value":560},", so a receiver restart doesn't drop the alert. One allowlist entry in Splunk Cloud covers every downstream destination, present and future.",{"type":38,"tag":62,"props":562,"children":564},{"id":563},"testing-without-triggering-real-alerts",[565],{"type":51,"value":566},"Testing without triggering real alerts",{"type":38,"tag":568,"props":569,"children":570},"ol",{},[571,590,595],{"type":38,"tag":396,"props":572,"children":573},{},[574,576,581,583,588],{"type":51,"value":575},"Capture one real firing into a ",{"type":38,"tag":126,"props":577,"children":578},{"href":128},[579],{"type":51,"value":580},"Webhook Bin",{"type":51,"value":582}," to see your instance's exact fields (custom search fields land in ",{"type":38,"tag":98,"props":584,"children":586},{"className":585},[],[587],{"type":51,"value":407},{"type":51,"value":589},").",{"type":38,"tag":396,"props":591,"children":592},{},[593],{"type":51,"value":594},"Replay it against your handler while you iterate — or send the catalog's Splunk sample.",{"type":38,"tag":396,"props":596,"children":597},{},[598],{"type":51,"value":599},"Wire the real alert to the relay endpoint once your handler behaves.",{"type":38,"tag":62,"props":601,"children":603},{"id":602},"related-reading",[604],{"type":51,"value":605},"Related reading",{"type":38,"tag":392,"props":607,"children":608},{},[609,617,625,633],{"type":38,"tag":396,"props":610,"children":611},{},[612],{"type":38,"tag":126,"props":613,"children":614},{"href":502},[615],{"type":51,"value":616},"Transform webhooks in flight",{"type":38,"tag":396,"props":618,"children":619},{},[620],{"type":38,"tag":126,"props":621,"children":622},{"href":520},[623],{"type":51,"value":624},"Deliver one webhook to multiple destinations",{"type":38,"tag":396,"props":626,"children":627},{},[628],{"type":38,"tag":126,"props":629,"children":630},{"href":538},[631],{"type":51,"value":632},"How to test webhooks",{"type":38,"tag":396,"props":634,"children":635},{},[636],{"type":38,"tag":126,"props":637,"children":639},{"href":638},"/blog/what-is-webhook",[640],{"type":51,"value":641},"What is a webhook",{"type":38,"tag":643,"props":644,"children":645},"style",{},[646],{"type":51,"value":647},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":184,"depth":184,"links":649},[650,651,652,653,654],{"id":64,"depth":158,"text":67},{"id":116,"depth":158,"text":119},{"id":458,"depth":158,"text":461},{"id":563,"depth":158,"text":566},{"id":602,"depth":158,"text":605},"markdown","content:blog:splunk-webhook-alerts.md","content","blog/splunk-webhook-alerts.md","blog/splunk-webhook-alerts","md",{"loc":4},1783373261919]