Can Splunk look for specific events and send them in an API to a third party ticketing system in JSON?

[cmeyer]

Hey everyone,

I am pretty unfamiliar with all of the functionality Splunk has to offer and am wondering if Splunk has the ability to look for specific events and if found, send that in an API to a third party ticketing system in JSON format.  I see Splunk has its own APIs to look for data that it has ingested but looking to send that data elsewhere.  Any help would be appreciated.  Thanks.

[PickleRick]

You can use the webhook alert action.

https://docs.splunk.com/Documentation/Splunk/9.0.0/Alert/Webhooks

If it's not enough you can always implement your own action.

[richgalloway]

Splunk supports outgoing links to ticketing systems, including ServiceNOW and JIRA.  Have you searched splunkbase for the name of your ticketing system?  Unfortunately, it's not easy to tell which apps are inbound and which are outbound without reading the details for each one.