Splunk integration
This integration ingests Splunk alerts and maps them to APEX AIOps Incident Management events automatically.
Create a new integration in Incident Management
Log in to your Incident Management instance.
Choose Integrations > Ingestion Services > Splunk.
Click Add New Integration.
The new integration includes a custom endpoint, a set of default mappings to convert Splunk payloads to Incident Management events, and a deduplication key to group similar events into alerts.
(Optional) Once your endpoint starts receiving data from Splunk, you can customize how the integration maps and deduplicates this data. To learn more about mapping and deduplication, read Use mapping types in custom integrations and Deduplicate events to reduce noise.
Configure your Splunk instance
Create and send alerts
Once your configuration is complete you can send data in various ways to Incident Management by customizing your alerts in Splunk.
Create a scheduled alert
To create a scheduled alert to send data in bulk to Incident Management:
Note
To avoid sending large Splunk payloads to Incident Management, it is good practice to send alerts at intervals of five minutes or less.
Set alerts for the data you want to ingest as defined by your search string:
search-query-string | field *Click Save As > Alert and specify an alert name.
Under Settings, select Alert Type as “Scheduled”.
Configure the alert schedule.
Under Trigger Actions, click Add Actions > Moogsoft Alert Integration.
Add additional trigger actions as deemed appropriate. For example, click Add Actions >Add to Triggered Alerts.
Click Save.
Bulk conversion of events
You can also perform bulk conversion of existing alerts to add (or remove) the Moog_Integration action. Use the commands addmoogsoftevent and removemoogsoftevent, in conjunction with a Splunk SPL command that queries the Splunk REST API.
For example, to add the Moog_Integration to all existing saved searches that have associated actions, you can use the following SPL query:
| rest /services/saved/searches | addmoogsoftevent
Create real-time alerts option
To create a Real Time alert in order to send an individual set of event data (this is the preferred way to avoid sending large payloads):
Set alerts for the data you want to ingest as defined by your search string: search-query-string.
Click Save As > Alert and specify an alert name.
Configure the alert schedule and select Alert Type as “Real Time”.
Set Alert Actions as “Moogsoft Alert Integration” and specify details.
Specify a search string option
From the Splunk New Search page, specify a search string for sending data to Incident Management:
search-query-string | moogsoftevent
For example, to send data in bulk, use the search string:
source="http:test" | moogsoftevent
For more information, go to docs.splunk.com and search for alerts.