Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Using Splunk integration, how do I reset or close an alert?

Mohamed Lrhazi November 6, 2021

When a splunk alert fires, Opsgenie action is triggered and an alert is created in Opsgenie. 

I would like a second splunk alert to close the previously open alert in Opsgenie when it fires. How can that be done?

For example one Splunk search detects website is down, and a second one detects website is UP.

 

Thanks!

 

1 answer

0 votes
Nick Haller
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
November 8, 2021

Hi @Mohamed Lrhazi ,

Using the advanced settings of the integration will empower you to fully customize your alerting. You can define when the system should create an alert, when it should execute a close action, acknowledge an alert automatically or add a note.

For example - the Create Alert action could create an alert when the Splunk search detects a website is DOWN, while the Close Alert action could close that existing alert when the Splunk search detects a website is UP. 

Note: closing an open existing Opsgenie alert through the integration is dependent on the alias field (also known as the unique identifier). Whatever data / fields you parse in the Create Alert action should be consistent with your Close Alert action (along with all integration actions). What data parses in the alias can also be configured under the advanced settings of the integration.

splunkcomm1.jpg

 

I don't personally have a Splunk instance, but here's an example of how that might be configured through an Email Integration - the idea is the same:

splunkcomm2.jpgsplunkcomm3.jpg

splunkcomm4.jpgsplunkcomm5.jpg

 

^ "XYZ123" was extracted into the alias of this alert upon creation, and was also used to identify which Opsgenie alert to close through the integration. Hope this helps! Let me know if you have any other questions.

 

Additional helpful links:

String Processing

Regex

Mohamed Lrhazi November 9, 2021

Thanks a lot @Nick Haller , but I don't think you are correct!

I tried what you describe, defining the create and close actions... It seems the client, the integration client, needs to send an actual close request... it needs to call the close_alert API endpoint....  The splunk integration script only calls the create alert endpoint.

 

I ended up creating my own splunk integration script to do this.

Like Nick Haller likes this

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
CLOUD
PERMISSIONS LEVEL
Product Admin
TAGS
AUG Leaders

Atlassian Community Events