Splunk Alerting to Slack

slack_alert.py

# Instructions:
# 1. Go to https://[yourdomain].slack.com/services/new
# 2. Configure a new Incoming WebHook and paste the URL below on Line 14
# 3. Copy this file into $SPLUNK_HOME$/bin/scripts
# 4. Configure your saved search to run slack_alert.py

from time import gmtime, strftime
import httplib, json
import getopt, sys, os
import subprocess
import gzip

def main():
  WEBHOOK_URL = '<WEBHOOK URI FROM SLACK APP>'
  headers = {'Content-Type': 'application/json'}

  text = 'Splunk Alert'
  color = 'good'

  f = gzip.open(sys.argv[8], 'rb')
  csv_content=f.read()
  current_time = strftime("%Y-%m-%d %H:%M:%S", gmtime()) 

  pretext = '*%s - %s:*' % (current_time, sys.argv[4])
  posttext = '<%s|Click here> for more details.' % sys.argv[6]

  message = {
    'text': pretext + '\n' + csv_content + posttext,
    'username': 'Splunk',
    'fallback': text,
    'color': color,
    'fields': [
      {
        'title': "Events",
        'value': sys.argv[1],
        'short': True
      }
    ]
  }

  connection = httplib.HTTPSConnection('hooks.slack.com')
  connection.request('POST', WEBHOOK_URL, json.dumps(message), headers)
  print json.dumps(message)
  response = connection.getresponse()
  print response.read().decode()

if __name__ == '__main__':
  main()