4,173 questions
Has Anyone Successfully Used a Teams WebHook to Post Alerts from Splunk into a Teams Channel?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(121.6, 17%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJA%3C/text%3E%3C/svg%3E)
John Apricena
1
Reputation point
Hello,
We used to run our Splunk logs direct into Slack, but recently we've migrated into Microsoft Teams and these alerts are working properly with our webhook. We are currently running into a 400-error code and was interested to know if anyone has alerts running from Splunk into a Teams Channel without error. Microsoft support directed us to try here and our Splunk support confirmed the data is properly leaving their end. Any assistance would be great appreciated!
Microsoft Teams | Development
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 48%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Sayali-MSFT 3,996 Reputation points Microsoft External Staff Moderator2022-12-22T09:24:49.193+00:00 @John Apricena - Thanks for reporting your issue.
We will check it with internal team and get back to you once we get any update. -
Sayali-MSFT 3,996 Reputation points Microsoft External Staff Moderator
2022-12-23T03:42:59.17+00:00 @John Apricena - Are you following the below document to setup the integration-
https://docs.splunk.com/observability/admin/notif-services/microsoftteams.htmlCould you please confirm where you are getting the 400 error?
-
John Apricena 1 Reputation point
2022-12-27T15:42:49.56+00:00 thank you @Sayali-MSFT
When the webhook is triggered from Splunk the response received from Teams is 400. The same webhook trigger sends the message correctly to the webhook site (no 400 is the error)
-
Sayali-MSFT 3,996 Reputation points Microsoft External Staff Moderator
2022-12-29T08:03:28.237+00:00 @John Apricena -Internal team is looking into it. We will inform you once we get any update.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 38%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWM%3C/text%3E%3C/svg%3E)
Wajeed-MSFT 311 Reputation points Microsoft Employee Moderator2023-01-03T06:23:15.64+00:00 @John Apricena - could you please share the payload being sent to Teams? One way to get payload would be by using temporary webhook in Splunk and record the payload.
https://www.google.com/search?q=test+webhook+url+online -
Sayali-MSFT 3,996 Reputation points Microsoft External Staff Moderator
2023-01-05T11:02:20.107+00:00 @John Apricena - Could you please share the payload being sent to Teams?
-
John Apricena 1 Reputation point
2023-01-05T14:39:46.443+00:00 Hello,
Sad to say, we don't have that, as it's sent by the Splunk SaaS server.
Sign in to comment
Sign in to answer