topic Re: How can I identify a different way to send a Splunk alert in an external system? in Other Usage

How can I identify a different way to send a Splunk alert in an external system?

jip31 — Thu, 25 May 2023 04:51:44 GMT

I would like to identify the different way to send splunk results alert in Centreon.

I know its possible to send Centreon events in Splunk with the Centreon steamer connector and the Splunk HTTP Event Collector but my need will be to send Splunk alerts in Centreon

Except in i am mistaken, the solution to interface splunk alerts with an external system will be to run a custom alert action with script (shell or python) using the results of a saved search ?

Is it exact? Is there any other solutions to do that?

Thanks for your help

Re: How can I identify a different way to send a Splunk alert in an external system?

gcusello — Thu, 25 May 2023 04:56:52 GMT

Hi @jip31 ,

I didn't tried to integrate Splunk with Centreon , so I hint to see is the "Centreon For Splunk" app has some feature to do this.

In general, as you said, it's possible to run a script (in the language you prefer) that calls the Centreon API and send an alert to Centreon.

Ciao.

Giuseppe

Re: How can I identify a different way to send a Splunk alert in an external system?

jip31 — Thu, 25 May 2023 05:08:51 GMT

Hi Gcusello

Thanks for your answer

Concerning the "Centreon For Splunk" addon, I have installed it in my DEV environment

When I create an alert, I can see a trigger called "Centreon Service Submit Result"

Pearhaps, this service is able to send alerts in Centreon?

If yes, what are the different tasks to configure this addon in order to send alert in my centreon platform correctly?

Thanks

Re: How can I identify a different way to send a Splunk alert in an external system?

gcusello — Thu, 25 May 2023 06:16:57 GMT

Hi @jip31 ,

it seems that in the app there's an alert action to send logs to Centreon,

see in documentation how to configure it, I connot help you more in this.

Ciao.

Giuseppe

Re: How can I identify a different way to send a Splunk alert in an external system?

gcusello — Thu, 25 May 2023 07:45:52 GMT

Hi @jip31 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉