Splunk – Custom Alert – Input Validation

I built a customize alert, and there are some required fields on the form. User must provide data for these fields. When we build the alert with Addon Builder, the code generated by the builder only validate the required fields when the alert is triggered.  This will cause some problems because the user is not aware of this.

We can’t use javascript in the html form, fortunately there is a solution, we can use the restmap.conf. This is the sample restmap.conf , you should put it in local\restmap.conf

The code below assume that your action name is “youractionname” and the required field is “title”

This is for one required fields,

1. [validation:savedsearch]
2. action.youractionname = case('action.youractionname' != "1", null(), 'action.youractionname.param.title' == "action.youractionname.param.title" OR 'action.youractionname.param.title' == "", "Title cannot be empty", 1==1, null())

If you have multiple required fields, this is a sample.

1. [validation:savedsearch]
2. action.youractionname = case('action.youractionname' != "1", null(), 'action.youractionname.param.title' == "action.youractionname.param.title" OR 'action.youractionname.param.title' == "", "Title cannot be empty",'action.youractionname.param.title2' == "action.youractionname.param.title2" OR 'action.youractionname.param.title2' == "", "Title2 cannot be empty", 1==1, null())