Written by Brendan Cooper, Splunk Professional Services consultant working for JDS Australia (https://www.jds.net.au), in Sydney, Australia.

What does this app do?

Enables an alert action that can send customised HTTP/REST requests to an endpoint. You can use search results from the alert to populate all the core fields of of the request including endpoint, headers, query string parameters and payload.

How does it work

After creating an alert, add the HTTP Alert Action at the bottom of the dialog. From there populate the fields as required.

Version (8.1.0)
The addon now uses Splunk's internal token replacement.
This provides a couple of benefits * More tokens are available - see docs link below * Switch to $$ instead of {} allows JSON payloads to be supported.
Please see https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens for more detail.

N.B. Custom Headers is a special field, as before each header should be separated using a '&'
eg. Header1=value1&Header2=value2

Version (<8.1.0)
For most of the fields you can parameterise data by enclosing the fields in {field_name}. Additional fields are seperated by &

For example, you could set a custom header with the following X-Forwarded-For={host}&Authorization=Splunk {token}

The fields you specify must exist exactly as named in the search results or substitution will be skipped for that section. ie If you have a payload of data={ThisFieldDoesNotExist} and querystring of param={ThisFieldDoesExist} then payload won't do substituion but querystring will.

Support

Support is not guaranteed and will be provided on a best effort basis.