<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: ZenDesk incident in Alerting</title>
    <link>https://community.splunk.com/t5/Alerting/ZenDesk-incident/m-p/74465#M1013</link>
    <description>&lt;P&gt;Here is a script I wrote to open a Zendesk ticket.  By naming the saved search with the proper fields, the fields get parsed out and make for a more meaningful ticket title.  It isn't pretty but should get you started.  It's written in Python 2.x:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;import pycurl
import StringIO
import sys
import re

# ---- Splunk Output (input for this script)
scriptName = sys.argv[0]      # Script name
eventReturned = sys.argv[1]   # Number of events returned
searchTerms = sys.argv[2]     # Search terms
queryString = sys.argv[3]     # Fully qualified query string
searchName = sys.argv[4]      # Name of saved search
triggerReason = sys.argv[5]   # Trigger reason
searchURL = sys.argv[6]       # URL to the saved search
resultsFileRaw = sys.argv[8]  # File where the results for this search are stored (raw)

# ---- Parse Splunk search name to help populate zendesk ticket
zdFields = re.match('^Saved\sSearch\s\["(?P&amp;lt;company&amp;gt;.*?)"\s(?P&amp;lt;priority&amp;gt;\d)\s"(?P&amp;lt;description&amp;gt;.*?)"\]\snumber\sof\sevents.*?$', triggerReason)
zdCompany = zdFields.group('company')
zdPriority = zdFields.group('priority')
zdDesc = zdFields.group('description')

# ---- Global Variables for CURL calls
xmlRequest = '&amp;lt;ticket&amp;gt;&amp;lt;subject&amp;gt;' + zdCompany + ': ' + zdDesc + '&amp;lt;/subject&amp;gt;&amp;lt;description&amp;gt;' + searchURL + '&amp;lt;/description&amp;gt;&amp;lt;priority-id&amp;gt;' + zdPriority + '&amp;lt;/priority-id&amp;gt;&amp;lt;ticket-type-id&amp;gt;2&amp;lt;/ticket-type-id&amp;gt;&amp;lt;requester_id&amp;gt;54&amp;lt;/requester_id&amp;gt;&amp;lt;/ticket&amp;gt;'
ncServerMaxTime = 1
zdURL = "http://sb.zendesk.com/tickets.xml"  # URL to your zendesk page
USER = "&amp;lt;username&amp;gt;"
PASS = "&amp;lt;password&amp;gt;"


# ---- Main
c = pycurl.Curl()
c.setopt(pycurl.URL, zdURL)
c.setopt(pycurl.POST, 1)
c.setopt(pycurl.USERPWD, "%s:%s" % (USER,PASS))
c.setopt(pycurl.HTTPHEADER, ["Content-Type: application/xml"])
c.setopt(pycurl.TIMEOUT, ncServerMaxTime)
c.setopt(pycurl.CONNECTTIMEOUT, ncServerMaxTime)
c.setopt(pycurl.NOSIGNAL, 1)
c.setopt(pycurl.POSTFIELDS, xmlRequest)
b = StringIO.StringIO()
c.setopt(pycurl.WRITEFUNCTION, b.write)
c.perform()
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Fri, 28 Sep 2012 23:02:35 GMT</pubDate>
    <dc:creator>sbrant_splunk</dc:creator>
    <dc:date>2012-09-28T23:02:35Z</dc:date>
    <item>
      <title>ZenDesk incident</title>
      <link>https://community.splunk.com/t5/Alerting/ZenDesk-incident/m-p/74464#M1012</link>
      <description>&lt;P&gt;Anyone create an App/script to integrate with ZenDesk (such as open an incident via API) which they wish to share?&lt;/P&gt;</description>
      <pubDate>Fri, 28 Sep 2012 11:49:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/ZenDesk-incident/m-p/74464#M1012</guid>
      <dc:creator>fman82</dc:creator>
      <dc:date>2012-09-28T11:49:31Z</dc:date>
    </item>
    <item>
      <title>Re: ZenDesk incident</title>
      <link>https://community.splunk.com/t5/Alerting/ZenDesk-incident/m-p/74465#M1013</link>
      <description>&lt;P&gt;Here is a script I wrote to open a Zendesk ticket.  By naming the saved search with the proper fields, the fields get parsed out and make for a more meaningful ticket title.  It isn't pretty but should get you started.  It's written in Python 2.x:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;import pycurl
import StringIO
import sys
import re

# ---- Splunk Output (input for this script)
scriptName = sys.argv[0]      # Script name
eventReturned = sys.argv[1]   # Number of events returned
searchTerms = sys.argv[2]     # Search terms
queryString = sys.argv[3]     # Fully qualified query string
searchName = sys.argv[4]      # Name of saved search
triggerReason = sys.argv[5]   # Trigger reason
searchURL = sys.argv[6]       # URL to the saved search
resultsFileRaw = sys.argv[8]  # File where the results for this search are stored (raw)

# ---- Parse Splunk search name to help populate zendesk ticket
zdFields = re.match('^Saved\sSearch\s\["(?P&amp;lt;company&amp;gt;.*?)"\s(?P&amp;lt;priority&amp;gt;\d)\s"(?P&amp;lt;description&amp;gt;.*?)"\]\snumber\sof\sevents.*?$', triggerReason)
zdCompany = zdFields.group('company')
zdPriority = zdFields.group('priority')
zdDesc = zdFields.group('description')

# ---- Global Variables for CURL calls
xmlRequest = '&amp;lt;ticket&amp;gt;&amp;lt;subject&amp;gt;' + zdCompany + ': ' + zdDesc + '&amp;lt;/subject&amp;gt;&amp;lt;description&amp;gt;' + searchURL + '&amp;lt;/description&amp;gt;&amp;lt;priority-id&amp;gt;' + zdPriority + '&amp;lt;/priority-id&amp;gt;&amp;lt;ticket-type-id&amp;gt;2&amp;lt;/ticket-type-id&amp;gt;&amp;lt;requester_id&amp;gt;54&amp;lt;/requester_id&amp;gt;&amp;lt;/ticket&amp;gt;'
ncServerMaxTime = 1
zdURL = "http://sb.zendesk.com/tickets.xml"  # URL to your zendesk page
USER = "&amp;lt;username&amp;gt;"
PASS = "&amp;lt;password&amp;gt;"


# ---- Main
c = pycurl.Curl()
c.setopt(pycurl.URL, zdURL)
c.setopt(pycurl.POST, 1)
c.setopt(pycurl.USERPWD, "%s:%s" % (USER,PASS))
c.setopt(pycurl.HTTPHEADER, ["Content-Type: application/xml"])
c.setopt(pycurl.TIMEOUT, ncServerMaxTime)
c.setopt(pycurl.CONNECTTIMEOUT, ncServerMaxTime)
c.setopt(pycurl.NOSIGNAL, 1)
c.setopt(pycurl.POSTFIELDS, xmlRequest)
b = StringIO.StringIO()
c.setopt(pycurl.WRITEFUNCTION, b.write)
c.perform()
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 28 Sep 2012 23:02:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/ZenDesk-incident/m-p/74465#M1013</guid>
      <dc:creator>sbrant_splunk</dc:creator>
      <dc:date>2012-09-28T23:02:35Z</dc:date>
    </item>
    <item>
      <title>Re: ZenDesk incident</title>
      <link>https://community.splunk.com/t5/Alerting/ZenDesk-incident/m-p/74466#M1014</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;This is not the answer, but maybe this could help!&lt;/P&gt;

&lt;P&gt;I tried this way: to get the list of all ticket from my Zendesk instance in .json format&lt;BR /&gt;
curl -u &lt;A href="mailto:username@example.com"&gt;username@example.com&lt;/A&gt;:password &lt;A href="https://my_instance.zendesk.com/api/v2/tickets.json"&gt;https://my_instance.zendesk.com/api/v2/tickets.json&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;or a particular ticket (in this case no. 13)&lt;BR /&gt;
curl -u &lt;A href="mailto:username@example.com"&gt;username@example.com&lt;/A&gt;:password &lt;A href="https://my_instance.zendesk.com/api/v2/tickets/13json"&gt;https://my_instance.zendesk.com/api/v2/tickets/13json&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;And the same way for users (clients):&lt;BR /&gt;
curl -u &lt;A href="mailto:username@example.com"&gt;username@example.com&lt;/A&gt;:password &lt;A href="https://my_instance.zendesk.com/api/v2/users.json"&gt;https://my_instance.zendesk.com/api/v2/users.json&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;For all other https methods I read cerefully:&lt;BR /&gt;
&lt;A href="https://developer.zendesk.com/rest_api/docs/core/introduction"&gt;https://developer.zendesk.com/rest_api/docs/core/introduction&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;Bye,&lt;BR /&gt;
Skender&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2015 14:29:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/ZenDesk-incident/m-p/74466#M1014</guid>
      <dc:creator>skender27</dc:creator>
      <dc:date>2015-09-28T14:29:32Z</dc:date>
    </item>
  </channel>
</rss>

