Integrating splunk with Statuspage.

Rakesh Singh_re3g6s

we have a requirement to show the service availability in statuspage.

All our systems are pushing the logs to splunk and i can see the data in splunk as well. Lets say if i create alerts based on the data in Splunk, can it be pushed to statuspage. ? 

If it is possible can you please guide me how can i achieve it ? 

 

Daniel Eads

Hi @Rakesh Singh , interesting question!

My personal preference would be to have something sitting between Splunk and Statuspage, which provides the following benefits:

• A real human is alerted of the problem before Statuspage is updated (incidents are less helpful if nobody is working on resolving them)
• The real human can filter out any false positives in Splunk alerts before pushing them to Statuspage

To do that, OpsGenie is a good go-between. The integration document here provides a couple use-cases that would be beneficial:
 

1. Opsgenie creates an incident in Atlassian Statuspage if an Opsgenie action is mapped to a create an incident or create incident and update the components'/incident's statuses according to tags Atlassian Statuspage action.

2. Opsgenie resolves incidents in Atlassian Statuspage if an Opsgenie action is mapped to a resolve the incident or resolve the incident and update the components' statuses according to tags Atlassian Statuspage action. Opsgenie updates the incident in Atlassian Statuspage if an Opsgenie action is mapped to an add note to the incident Atlassian Statuspage action.

 

If for some reason you didn't want to have an incident management service in the middle, you could update Statuspage directly with emails. Each component on the page has its own unique email address, and you can trigger updates via email with UP or DOWN in the subject line. Get started with email automation contains the particulars for Statuspage, and Splunk's documentation can help you modify the alert email from Splunk.

Cheers,
Daniel