Integrate with Splunk IT Service Intelligence

Splunk ITSI has a notable event functionality to create alerts or trigger a script. Use Splunk ITSI alerts to monitor for and respond to specific events. Alerts use a saved search to look for events in real time or on a schedule. Alerts are triggered when search results meet specific conditions. Alert actions can be used to respond when alerts trigger.

What does the integration offer?

Splunk IT Service Intelligence's easily sift through vast amounts of events by filtering and sorting them based on priority. Additionally, Splunk ITSI triggers alerts, initiates remediation, and automates incident workflows. Real-time anomaly detection also reduces alert fatigue. Through Compass for Splunk ITSI app, forward Splunk ITSI alerts to Compass. With the Splunk ITSI Integration, Compass acts as a dispatcher for these alerts, determines the right people to notify based on on-call schedules, notifies via email, text messages (SMS), phone calls, and iOS and Android push notifications, and escalates alerts until the alert is acknowledged or closed.

How does the integration work?

Compass has a Splunk ITSI specific alert app to send Splunk ITSI alerts to Compass. Compass also has a specific API for Splunk ITSI Integration, Splunk ITSI sends alerts through Compass for Splunk ITSI app to Compass and Compass handles the automatic creation of alerts.

Set up the integration

Splunk ITSI is a bidirectional integration. Setting it up involves the following steps:

• Add a Splunk ITSI integration in Compass

• Configure the integration in Splunk ITSI

Add a Splunk ITSI integration

To add a Splunk ITSI integration in Compass, complete the following steps:

1. Go to your team’s operations page.

2. On the left navigation panel, select Integrations and then Add integration.

3. Run a search and select “Splunk ITSI”.

4. On the next screen, enter a name for the integration.

5. Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.

6. Select Continue.
   The integration is saved at this point.

7. Expand the Steps to configure the integration section and copy the API URL.
   You will use this key while configuring the integration in Splunk ITSI later.

8. Select Turn on integration.
   The rules you create for the integration will work only if you turn on the integration.

Configure the integration in Splunk ITSI

To configure the integration of Splunk ITSI with Compass, complete the following steps:

1. In Splunk, install the Compass for Splunk ITSI app from Splunkbase.

2. Go to your apps and select Set Up to configure the Compass app.

3. Select the notable event for which you want to create an alert.

4. Select Compass Manage Event with Compass from Actions.

5. Paste the API URL previously copied from Compass into JSM API URL.

6. Set the priority.

7. Select Done.

Update the API URL

Update the default API URL and priority in alert_actions.conf for $SPLUNK_HOME/etc/apps/jsm_itsi/default.

Review the app logs

If any problems occur while creating an alert at Compass, check the app logs in $SPLUNK_HOME/var/log/splunk/jsm_itsi.log.

Create alerts in Notable Events Review

1. In IT Service Intelligence, go to the Notable Events Review page.

2. Select on a Notable Event to create an alert.

3. Select Actions > Manage Event with Compass.

Create automatized alerts using Notable Event Aggregation Policies

1. Select Configure > Notable Event Aggregation Policies.

2. Create a New Notable Event Aggregation Policy or edit an existing one.

3. In the Action Rules tab, add a Rule and update action to "Manage Event with Compass".

4. Select Configure and use the API URL copied previously and select the priority.

5. Click Save.

Map alert actions

Compass allows you to map alert actions between Compass actions and Splunk ITSI.

For alerts created by Splunk ITSI

• Use this section to map Compass actions to Splunk ITSI actions when the source of the alert is Splunk ITSI (i.e When the alert is created by Splunk ITSI integration.)

• Map different Compass actions to different Splunk ITSI actions. For example, set the Notable Event status to "In Progress" in Splunk ITSI, when the alert is acknowledged. In order to do this, define "If alert is acknowledged in Compass", "update Notable Event Status to In Progress" mapping in the "Send Alert Updates Back to Splunk ITSI" section.

After the update action is triggered in Compass, updates are sent back to the Notable Event and updates are viewed from the "Activity" tab.

Sample payload sent from Splunk and dynamic properties in Compass

Create Alert payload

JSON