Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
Next:
badges earned

Your Points Tracker
Challenges
Leaderboard
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Recognition
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Kudos
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Use Splunk together with Opsgenie

Hi there,

in our Opsgenie there is already a team that has a Splunk integration.

But I need to establish another connection from Splunk to Opsgenie for my team.

As far as I understand Splunk only supports 1 API key for Opsgenie.

 

So can I use some forwarding mechanism, something like a dispatcher?

For example "Only those Splunk alerts which starts with 'WEB' are to be forwarded to my team, as a fall-back all other ones are to be forwarded to the other team".

 

Thanks,

Marco

 

2 answers

1 accepted

0 votes
Answer accepted

Hi Marco,

We had the same problem. We solved it using the API integration in Opsgenie and sending POST request from Splunk.

We are using HTTP Alert Action https://splunkbase.splunk.com/app/5022/ in Splunk to send the POST requests alerts to the API. This is an action that you can select on the alerts.

You need to specify the API key. You can configure as many API incoming integrations in Opsgenie as you want and assign them to a team (the owner team) and you will receive a different API key per integration. Unfortunately, the API key is passed as a header and it is in clear in the Splunk action.

Hope it helps. If you need more information about this we dig deeper on this solution.

Best regards,

Jorge.

Thanks a lot for this

Like Jorge Gomez Rivas likes this

Okay, I got no answer on this. Maybe I can paint another solution which leads to another question.

So we have 2 teams in Obsgenie, let's name them Team Frontend (FE) and Team Backend (BE).
Currently FE is receiving all Splunk alerts, and BE gets nothing. A second plugin especially for BE didn't work.

So maybe we can create a new team, like Team Splunk-Receivers (SR). SR get all Splunk alerts, FE and BE get nothing. We create at least 2 alerts within SR, one that filters all frontend stuff, and one that gets the backend ones. Each alert adds a tag (e.g. FE and BE) to the alerts.

Now we have Team SR with all Splunk alerts, that are filtered and tagged.

Is it possible to forward those tagged alerts to another team, FE and BE to be more detailed?

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Opsgenie

How do I use Zebrium + Opsgenie for Root Cause Analysis (RCA)?

This article was co-authored by Gavin Cohen of Zebrium. Zebrium has a bi-directional integration with Opsgenie and is a machine learning solution for RCA.  We all know the drill. 💤 You'r...

320 views 0 3
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you