Prediction JSON payload Splunk alert - json

Question

At the moment I am busy working on something that requires input from a Splunk alert.
However, I am having trouble in discovering what the JSON output for the alert might be. I was wondering if anyone knows a way to predict JSON output accurately.
I know the specifics of the event that gives the alert and, of course, the details for the alert itself.
I am not allowed to share, unfortunately. I have a webhook, but it's not online yet, only reachable from localhost, because security has not been fitted appropriately yet. That's why I can't simply send an alert to test it.
Instead I want to send a curl with 'example' JSON output, but because there needs to be some decryption on that sample output, I would like for it to be quite accurate instead of simply taking a wild guess at it.
Is there anybody who can tell me how to predict the JSON payload?

Answer 1

No need to guess the JSON payload, Splunk publishes the structure of the JSON messages made from webhook alert actions.
See https://docs.splunk.com/Documentation/Splunk/8.0.5/Alert/Webhooks
Example:
{
"result": {
"sourcetype" : "mongod",
"count" : "8"
},
"sid" : "scheduler_admin_search_W2_at_14232356_132",
"results_link" : "http://web.example.local:8000/app/search/#go?sid=scheduler_admin_search_W2_at_14232356_132",
"search_name" : null,
"owner" : "admin",
"app" : "search"
}
If this fixes your problem, take a moment to accept the answer. This can be done by clicking on the check mark beside the answer to toggle it from greyed out to filled in!