Getting Data In

How to integrate Incident management ticketing tool with splunk enterprise?

Vinesh93
Explorer

I have tried to find an app that can integrate Incident management ticketing tool with splunk but couldn'd. Is there any other option that can be used to do so?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help if you said what incident management tool you use. If you don't find an app in splunkbase, you still have a few options:

1) Contact the vendor to see if they have an app for Splunk
2) Install a universal forwarder on the system hosting the IM software and forward logs/files to Splunk
3) Use the vendor's API to create a modular input to extract the information you desire
4) Use DB Connect to extract data from the IM system's SQL database.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help if you said what incident management tool you use. If you don't find an app in splunkbase, you still have a few options:

1) Contact the vendor to see if they have an app for Splunk
2) Install a universal forwarder on the system hosting the IM software and forward logs/files to Splunk
3) Use the vendor's API to create a modular input to extract the information you desire
4) Use DB Connect to extract data from the IM system's SQL database.

---
If this reply helps you, Karma would be appreciated.
0 Karma

koshyk
Super Champion

Quite few lot of options

High level, two ways
1. Pull option . => You poll regularly from the Incident Management tool into Splunk (eg API of your tool, SOAP, directly Database etc.)
2. Push option . => The Tool can send the data to you (mostly HEC)

For option1, lot of incident management tools have addons (TA) for example ServiceNow Addon which can you just configure with credentials to pull information on regular basis.
There are other few as well apps too.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...