splunk / terraform-provider-splunk

Terraform Provider for Splunk
Mozilla Public License 2.0
103 stars 77 forks source link

Add support for Alerts MS Teams Notifcations #191

Closed Stan0304 closed 3 months ago

Stan0304 commented 3 months ago

The current Splunk terraform provider does not allow to create Splunk Alerts using "MS Teams" notification. This merge request adds the required parameters to support the creation of "MS Teams" notification

resource "splunk_saved_searches" "saved_search" {
    name = "Test New Alert"
    search = "index=main"
    actions = "ms_teams_publish_to_channel"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_url = "https://accor.webhook.office.com/webhookb2/xxx-xxxx-xxxx/IncomingWebhook/xxxx"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_activity_title = "Splunk Alert"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_fields_list = "_raw"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_fields_order = "order_by_list"
    dispatch_earliest_time = "-15m"
    dispatch_latest_time = "-0m"
    cron_schedule = "*/5 * * * *"
    acl {
      owner = "admin"
      sharing = "app"
      app = "launcher"
    }
}

The code above leads to an Alerts with a "MS Teams" notification enabled

image