Slack Bot Alert Connector for Splunk

The Slack Bot Alert Connector for Splunk is a search-head add-on that delivers Splunk saved-search alert notifications to Slack channels through the Slack App bot token authentication model. The add-on implements a custom alert action that invokes Slack's chat.postMessage API to post formatted messages containing alert metadata, search results links, and configurable result fields. It handles channel membership automatically by detecting not_in_channel errors and optionally joining channels on behalf of the bot before retrying the post. Slack bot tokens are stored in Splunk's encrypted credential storage and transmitted exclusively in Authorization headers. The add-on redacts token-like strings from internal logs and does not persist alert message bodies or event payloads to disk. It is designed for installation on Splunk Enterprise 10.x and Splunk Cloud Platform search heads in standalone, distributed, or clustered configurations.