splunk / terraform-provider-splunk

Terraform Provider for Splunk
Mozilla Public License 2.0
102 stars 75 forks source link

Add ms teams alert notification support #192

Open Stan0304 opened 2 weeks ago

Stan0304 commented 2 weeks ago

The current Splunk terraform provider does not allow to create Splunk Alerts using "MS Teams" notification. This merge request adds the required parameters to support the creation of "MS Teams" notification

resource "splunk_saved_searches" "saved_search" {
    name = "Test New Alert"
    search = "index=main"
    actions = "ms_teams_publish_to_channel"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_url = "https://accor.webhook.office.com/webhookb2/xxx-xxxx-xxxx/IncomingWebhook/xxxx"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_activity_title = "Splunk Alert"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_fields_list = "_raw"
    action_ms_teams_publish_to_channel_param_alert_ms_teams_fields_order = "order_by_list"
    dispatch_earliest_time = "-15m"
    dispatch_latest_time = "-0m"
    cron_schedule = "*/5 * * * *"
    acl {
      owner = "admin"
      sharing = "app"
      app = "launcher"
    }
}

The code above leads to an Alerts with a "MS Teams" notification enabled

image