topic ITSI Webhook Integration in Splunk ITSI

ITSI Webhook Integration

Kaitsu — Fri, 27 Mar 2026 06:27:21 GMT

Hi everyone,

I’m currently working on a new Splunk deployment, migrating from a different event management tool to Splunk 10.0.2 and ITSI 4.21.1. We are running a Search Head Cluster (SHC) with three members.

As I’m still relatively new to Splunk, I wanted to check if I’ve missed a configuration step: I noticed that a Webhook (ITSI Data integrations/Integrations library/Webhooks)
I configured on one member isn't visible on the other two members of the cluster.

Shouldn't these configurations sync automatically across the SHC, or is there a specific step I need to take to replicate Webhook settings in ITSI?

Thanks in advance for the help!

Re: ITSI Webhook Integration

kknairr — Mon, 30 Mar 2026 17:37:40 GMT

@Kaitsu Webhook integrations in ITSI do not automatically sync across Search Head Cluster members unless they are created via the deployer. What you are seeing is expected if the webhook was configured locally on one node. The correct approach is to configure integrations via the deployer, so they propagate to all SHC members.

Refer this doc:

Install IT Service Intelligence in a search head cluster environment | Splunk Cloud Platform, Splunk Enterprise (last updated 2025-07-23T14:48:02.950Z)

If this post addressed your question, you can:

Give it karma to show appreciation 👍
Mark it as the solution if it solved your issue ✔️
Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

Re: ITSI Webhook Integration

livehybrid — Sun, 29 Mar 2026 21:35:50 GMT

Hi @kknairr I dont think that is strictly true? Im sure Ive seen ITSI Webhooks from the Integrations Library which have been created in the GUI and synced themselves between members of the SHC just like many other ITSI configs?

I cant see anything in the referenced docs relating to this either, its true when first deploying ITSI to the SHC you would use the deployer (+ perhaps manual conf changes) but not sure about making UI changes directly on the captain only?

Also 'unless they are created on the cluster captain and replicated via the deployer' are two conflicting actions?

Please could you clarify?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: ITSI Webhook Integration

PickleRick — Mon, 30 Mar 2026 08:24:59 GMT

Cluster captaincy doesn't have anything to do with deploying apps!

A user normally doesn't even know what and where the captain is.

Anyway, normally the config is either defined as an app on the _deployer_ and pushed to the SHC members or config elements are set using REST API (which WebUI uses as well) and are then replicated using clustering mechanisms to all SHC members.

I don't think ITSI as such introduces any limitations to the normal SH clustering management operations.

So the thing you _don't_ want to do is define configuration entries _by means of directly editing config files_ on a single SHC member. Those might not be replicated to other peers and might get overwritten with settings from other peers.

Re: ITSI Webhook Integration

kknairr — Mon, 30 Mar 2026 17:41:54 GMT

@livehybrid / @PickleRick I meant pushing via deployer only. Updating in captain node also won't help in this case. Thanks for pointing it out.

Re: ITSI Webhook Integration

Kaitsu — Tue, 31 Mar 2026 05:11:31 GMT

Thanks for the replies. I’ll will do the configuration via the Deployer.

Re: ITSI Webhook Integration

kknairr — Tue, 31 Mar 2026 17:13:16 GMT

@Kaitsu You're welcome. Let us know if you face any further issues. Thank you.