Skip to content

Splunk Provider

This doc show how to send splunk alerts to EMS via splunk provider.

Request API

/alerts/event/splunk

Request Method

POST

Request Body

{
  "search_name": "Test Splunk Alert Title",
  "sid": "test_splunk_alert_1234",
  "results_link": "https://prd-p-xxxx.splunkcloud.com/app/search/@go?sid=1673627837.1234",
  "app": "wxcce",
  "owner": "admin",
  "log_level": "5",
  "result": {
    "host": "server2",
    "alertType": "HighWaterMarkExceeded",
    "deviceType": "CUCM",
    "message": " test alert message"
  },
  "product": "WxCCE"
}
Note: Do not include the "id" field in the payload.

Body validation

  1. search_name: required, alert name.
  2. sid: required.
  3. results_link: required, url in alert.
  4. log_level: required, alert severity, see Severity Map.
  5. result.message: required, alert description.

Note: You can add the additional fields anywhere in the request body, but to avoid the conflict of some default fields, we highly recommend you add additional fields as in the above sample.

Severity Map

{
        "LOW": AlertSeverity.LOW,
        "INFO": AlertSeverity.INFO,
        "WARNING": AlertSeverity.WARNING,
        "ERROR": AlertSeverity.HIGH,
        "CRITICAL": AlertSeverity.CRITICAL,
        "1": AlertSeverity.LOW,
        "2": AlertSeverity.INFO,
        "3": AlertSeverity.WARNING,
        "4": AlertSeverity.HIGH,
        "5": AlertSeverity.CRITICAL,
    }

Default Deduplicate Rule

exception + logger + service