Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Using Splunk integration, how do I reset or close an alert?

When a splunk alert fires, Opsgenie action is triggered and an alert is created in Opsgenie. 

I would like a second splunk alert to close the previously open alert in Opsgenie when it fires. How can that be done?

For example one Splunk search detects website is down, and a second one detects website is UP.




1 answer

0 votes
Nick H
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Nov 08, 2021 • edited

Hi @Mohamed Lrhazi ,

Using the advanced settings of the integration will empower you to fully customize your alerting. You can define when the system should create an alert, when it should execute a close action, acknowledge an alert automatically or add a note.

For example - the Create Alert action could create an alert when the Splunk search detects a website is DOWN, while the Close Alert action could close that existing alert when the Splunk search detects a website is UP. 

Note: closing an open existing Opsgenie alert through the integration is dependent on the alias field (also known as the unique identifier). Whatever data / fields you parse in the Create Alert action should be consistent with your Close Alert action (along with all integration actions). What data parses in the alias can also be configured under the advanced settings of the integration.



I don't personally have a Splunk instance, but here's an example of how that might be configured through an Email Integration - the idea is the same:




^ "XYZ123" was extracted into the alias of this alert upon creation, and was also used to identify which Opsgenie alert to close through the integration. Hope this helps! Let me know if you have any other questions.


Additional helpful links:

String Processing


Thanks a lot @Nick H , but I don't think you are correct!

I tried what you describe, defining the create and close actions... It seems the client, the integration client, needs to send an actual close request... it needs to call the close_alert API endpoint....  The splunk integration script only calls the create alert endpoint.


I ended up creating my own splunk integration script to do this.

Like Nick H likes this

Suggest an answer

Log in or Sign up to answer
Site Admin
AUG Leaders

Atlassian Community Events