Thanks @sungod for posting your solution. I'm glad you found the webhook templates, because this is exactly what they were made for. I started writing a template for Splunk, but did not have a test environment to verify. Here is what I have created so far, but I would love some validation. This can then be shared on our github repo containing all of our open source webhook templates. HTTP Server URL: https://mysplunkserver.example.com:8088/services/collector/event sharedSecret set to your Splunk Token (i.e. `12345678-1234-1234-1234-1234567890AB`) Splunk API Docs Headers template {
"Authorization": "Splunk {{sharedSecret}}",
"X-Splunk-Request-Channel": "XXXXXX"
} Body template {
"time":{{sentAt | date:"%s"}},
"host": "api.meraki.com",
"source": "{{networkName}}",
"sourceType":"main",
"event" : {
"sentAt": "{{sentAt}}",
"organizationId": "{{organizationId}}",
"organizationName": "{{organizationName}}",
"organizationUrl": "{{organizationUrl}}",
"networkId": "{{networkId}}",
"networkName": "{{networkName}}",
"networkUrl": "{{networkUrl}}",
"networkTags": {{ networkTags | jsonify }},
"deviceSerial": "{{deviceSerial}}",
"deviceMac": "{{deviceMac}}",
"deviceName": "{{deviceName}}",
"deviceUrl": "{{deviceUrl}}",
"deviceTags": {{ deviceTags | jsonify }},
"deviceModel": "{{deviceModel}}",
"alertId": "{{alertId}}",
"alertType": "{{alertType}}",
"alertTypeId": "{{alertTypeId}}",
"alertLevel": "{{alertLevel}}",
"occurredAt": "{{occurredAt}}",
"alertData": {{ alertData | jsonify }}
}
}
... View more
