Splunk Alert Webhook to Email & Telegram (n8n Workflow)

Get Splunk alerts to email and Telegram automatically—powered by n8n

This n8n workflow receives Splunk webhook alerts, normalizes and validates the payload, and then routes notifications by severity: critical/high alerts go to both HTML email and Telegram, while medium/low/informational alerts are sent via HTML email. Perfect for security teams and SaaS operators who need fast, reliable alerting.

What this workflow does

• Receives Splunk Webhook POSTs when a configured Splunk alert triggers.
• Normalizes the payload into consistent fields, including alert name, severity, source IP, failed attempts, targeted users and hosts, timestamps, and the Splunk results link.
• Validates incoming data and filters out invalid payloads before any notification is sent.
• Normalizes severity values, and when Splunk does not provide a supported severity, assigns one based on the number of failed attempts.
• Routes by severity:
  • Critical & High: sends an urgent HTML email and a Telegram message with relevant alert details.
  • Medium, Low & Informational: sends a formatted HTML email including alert details and a link back to Splunk when available.

Use cases

• Notify security engineers immediately when authentication failures spike (critical/high → Telegram + email).
• Send routine operational insights (medium/low/info → email) with direct links to Splunk results.
• Unify Splunk alert delivery without manual copy/paste—using a single n8n webhook endpoint.

Technical details

• n8n nodes/logic: Webhook, if, code, filter, Telegram, Email Send.
• Splunk integration: configure a Splunk alert action to use the workflow’s webhook Production URL.
• Severity handling: normalizes supported severities; auto-assigns severity when Splunk severity isn’t supported (based on failed attempts).

Setup (quick start)

• Import the workflow into n8n, open “When Splunk Notification Received” Webhook, copy the Production URL, and activate the workflow.
• In Splunk, set your saved search/alert Webhook alert action destination to the n8n workflow endpoint.