All Apps and Add-ons

Has anyone set up automatic ingestion of PagerDuty Incident data into Splunk?

briancronrath
Contributor

Wondering if anyone can suggest a good method of how to ingest PagerDuty incident data into splunk. Trying to leverage Splunk to create a dashboard showing who/which groups get paged and for what commons things they get paged for. It looks like the PagerDuty integration app only is a one way street of sending Splunk data over to PagerDuty - does anyone know of an app or similar that can ingest data the other direction of PagerDuty over to Splunk? Or do I need to create a customized script to accomplish this?

1 Solution

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

View solution in original post

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...