{"product_id":"splunk-alert-webhook-to-email-telegram-n8n-workflow","title":"Splunk Alert Webhook to Email \u0026 Telegram (n8n Workflow)","description":"\u003ch3\u003eGet Splunk alerts to email and Telegram automatically—powered by n8n\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow receives \u003cstrong\u003eSplunk webhook alerts\u003c\/strong\u003e, normalizes and validates the payload, and then routes notifications by severity: \u003cstrong\u003ecritical\/high alerts go to both HTML email and Telegram\u003c\/strong\u003e, while \u003cstrong\u003emedium\/low\/informational alerts are sent via HTML email\u003c\/strong\u003e. Perfect for security teams and SaaS operators who need fast, reliable alerting.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eReceives Splunk Webhook POSTs\u003c\/strong\u003e when a configured Splunk alert triggers.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eNormalizes the payload\u003c\/strong\u003e into consistent fields, including alert name, severity, source IP, failed attempts, targeted users and hosts, timestamps, and the \u003cem\u003eSplunk results link\u003c\/em\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eValidates incoming data\u003c\/strong\u003e and filters out invalid payloads before any notification is sent.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eNormalizes severity values\u003c\/strong\u003e, and when Splunk does not provide a supported severity, \u003cstrong\u003eassigns one based on the number of failed attempts\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRoutes by severity\u003c\/strong\u003e:\n    \u003cul\u003e\n      \u003cli\u003e\n\u003cstrong\u003eCritical \u0026amp; High\u003c\/strong\u003e: sends an \u003cstrong\u003eurgent HTML email\u003c\/strong\u003e and a \u003cstrong\u003eTelegram\u003c\/strong\u003e message with relevant alert details.\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eMedium, Low \u0026amp; Informational\u003c\/strong\u003e: sends a \u003cstrong\u003eformatted HTML email\u003c\/strong\u003e including alert details and a link back to Splunk when available.\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eNotify security engineers immediately when authentication failures spike (critical\/high → Telegram + email).\u003c\/li\u003e\n  \u003cli\u003eSend routine operational insights (medium\/low\/info → email) with direct links to Splunk results.\u003c\/li\u003e\n  \u003cli\u003eUnify Splunk alert delivery without manual copy\/paste—using a single n8n webhook endpoint.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003en8n nodes\/logic\u003c\/strong\u003e: Webhook, if, code, filter, Telegram, Email Send.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSplunk integration\u003c\/strong\u003e: configure a Splunk alert action to use the workflow’s webhook \u003cstrong\u003eProduction URL\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSeverity handling\u003c\/strong\u003e: normalizes supported severities; auto-assigns severity when Splunk severity isn’t supported (based on failed attempts).\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eSetup (quick start)\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eImport the workflow into n8n, open \u003cstrong\u003e“When Splunk Notification Received” Webhook\u003c\/strong\u003e, copy the Production URL, and activate the workflow.\u003c\/li\u003e\n  \u003cli\u003eIn Splunk, set your saved search\/alert \u003cstrong\u003eWebhook alert action\u003c\/strong\u003e destination to the n8n workflow endpoint.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":46075759788211,"sku":"N8N-19818","price":72.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/jK1dmJEFi8QJ5I5rGSBUp_eq28nzzy.png?v=1790154493","url":"https:\/\/buyflowscripts.com\/products\/splunk-alert-webhook-to-email-telegram-n8n-workflow","provider":"N8N Commerce","version":"1.0","type":"link"}