slack-alerts
slack-alerts copied to clipboard
Message should be made a required field in the app
Describe the bug
You can create a slack action, with leaving the Message field empty. The result is a created alert that shows it's firing to slack but does not actually send anything to slack. The error message for this is reports errors events in separate events than the mentioned alert name so it's hard to debug and correlate the error to a particular event. (tried using the id),Especially when you have many alerts.
Invoking modular alert action=slack for search="<some_alert_name>" sid="<some_alert_sid>" in app="search" owner="user" type="saved"
FATAL sendmodalert [12322 AlertNotifierWorker-0] - action=slack STDERR - Validation error: Parameter `message` is missing or empty
https://github.com/splunk/slack-alerts/blob/8e85cc9ab65cb4983b42b5de3e81fd968a3bb842/src/app/default/data/ui/alerts/slack.html#L15
A validation needs to be added https://github.com/splunk/slack-alerts/blob/main/src/app/default/restmap.conf
To Reproduce Steps to reproduce the behavior: Create alert without Message, notice it won't be sent to Slack.
Expected behavior Alert is sent to slack.