Using Splunk integration, how do I reset or close an alert?

[Mohamed Lrhazi]

When a splunk alert fires, Opsgenie action is triggered and an alert is created in Opsgenie. 

I would like a second splunk alert to close the previously open alert in Opsgenie when it fires. How can that be done?

For example one Splunk search detects website is down, and a second one detects website is UP.

Thanks!

[Nick H]

Hi @Mohamed Lrhazi ,

Using the advanced settings of the integration will empower you to fully customize your alerting. You can define when the system should create an alert, when it should execute a close action, acknowledge an alert automatically or add a note.

For example - the Create Alert action could create an alert when the Splunk search detects a website is DOWN, while the Close Alert action could close that existing alert when the Splunk search detects a website is UP. 

Note: closing an open existing Opsgenie alert through the integration is dependent on the alias field (also known as the unique identifier). Whatever data / fields you parse in the Create Alert action should be consistent with your Close Alert action (along with all integration actions). What data parses in the alias can also be configured under the advanced settings of the integration.

I don't personally have a Splunk instance, but here's an example of how that might be configured through an Email Integration - the idea is the same:

^ "XYZ123" was extracted into the alias of this alert upon creation, and was also used to identify which Opsgenie alert to close through the integration. Hope this helps! Let me know if you have any other questions.

Additional helpful links:

String Processing

Regex

[Mohamed Lrhazi]

Thanks a lot @Nick H , but I don't think you are correct!

I tried what you describe, defining the create and close actions... It seems the client, the integration client, needs to send an actual close request... it needs to call the close_alert API endpoint....  The splunk integration script only calls the create alert endpoint.

I ended up creating my own splunk integration script to do this.