Use Splunk together with Opsgenie

unknown

Hi there,

in our Opsgenie there is already a team that has a Splunk integration.

But I need to establish another connection from Splunk to Opsgenie for my team.

As far as I understand Splunk only supports 1 API key for Opsgenie.

 

So can I use some forwarding mechanism, something like a dispatcher?

For example "Only those Splunk alerts which starts with 'WEB' are to be forwarded to my team, as a fall-back all other ones are to be forwarded to the other team".

 

Thanks,

Marco

 

Jorge Gomez Rivas

Hi Marco,

We had the same problem. We solved it using the API integration in Opsgenie and sending POST request from Splunk.

We are using HTTP Alert Action https://splunkbase.splunk.com/app/5022/ in Splunk to send the POST requests alerts to the API. This is an action that you can select on the alerts.

You need to specify the API key. You can configure as many API incoming integrations in Opsgenie as you want and assign them to a team (the owner team) and you will receive a different API key per integration. Unfortunately, the API key is passed as a header and it is in clear in the Splunk action.

Hope it helps. If you need more information about this we dig deeper on this solution.

Best regards,

Jorge.