All Apps and Add-ons

Has anyone set up automatic ingestion of PagerDuty Incident data into Splunk?

briancronrath
Contributor

Wondering if anyone can suggest a good method of how to ingest PagerDuty incident data into splunk. Trying to leverage Splunk to create a dashboard showing who/which groups get paged and for what commons things they get paged for. It looks like the PagerDuty integration app only is a one way street of sending Splunk data over to PagerDuty - does anyone know of an app or similar that can ingest data the other direction of PagerDuty over to Splunk? Or do I need to create a customized script to accomplish this?

0 Karma
1 Solution

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

View solution in original post

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...