https://community.splunk.com/t5/Getting-Data-In/How-to-integrate-Incident-management-ticketing-tool-with-splunk/m-p/453744#M78583 <P>I have tried to find an app that can integrate Incident management ticketing tool with splunk but couldn'd. Is there any other option that can be used to do so?</P> Mon, 13 May 2019 12:01:37 GMT Vinesh93 2019-05-13T12:01:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-integrate-Incident-management-ticketing-tool-with-splunk/m-p/453744#M78583 <P>I have tried to find an app that can integrate Incident management ticketing tool with splunk but couldn'd. Is there any other option that can be used to do so?</P> Mon, 13 May 2019 12:01:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-integrate-Incident-management-ticketing-tool-with-splunk/m-p/453744#M78583 Vinesh93 2019-05-13T12:01:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-integrate-Incident-management-ticketing-tool-with-splunk/m-p/453745#M78584 <P>Quite few lot of options</P> <P>High level, two ways<BR /> 1. Pull option . =&gt; You poll regularly from the Incident Management tool into Splunk (eg API of your tool, SOAP, directly Database etc.)<BR /> 2. Push option . =&gt; The Tool can send the data to you (mostly HEC)</P> <P>For option1, lot of incident management tools have addons (TA) for example <A href="https://splunkbase.splunk.com/app/1928/">ServiceNow Addon</A> which can you just configure with credentials to pull information on regular basis.<BR /> There are <A href="https://splunkbase.splunk.com/apps/#/search/incident/">other few as well</A> apps too. </P> Mon, 13 May 2019 13:18:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-integrate-Incident-management-ticketing-tool-with-splunk/m-p/453745#M78584 koshyk 2019-05-13T13:18:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-integrate-Incident-management-ticketing-tool-with-splunk/m-p/453746#M78585 <P>It would help if you said what incident management tool you use. If you don't find an app in splunkbase, you still have a few options:</P> <P>1) Contact the vendor to see if they have an app for Splunk<BR /> 2) Install a universal forwarder on the system hosting the IM software and forward logs/files to Splunk<BR /> 3) Use the vendor's API to create a modular input to extract the information you desire<BR /> 4) Use DB Connect to extract data from the IM system's SQL database.</P> Mon, 13 May 2019 13:20:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-integrate-Incident-management-ticketing-tool-with-splunk/m-p/453746#M78585 richgalloway 2019-05-13T13:20:49Z