All Apps and Add-ons

Has anyone set up automatic ingestion of PagerDuty Incident data into Splunk?

briancronrath
Contributor

Wondering if anyone can suggest a good method of how to ingest PagerDuty incident data into splunk. Trying to leverage Splunk to create a dashboard showing who/which groups get paged and for what commons things they get paged for. It looks like the PagerDuty integration app only is a one way street of sending Splunk data over to PagerDuty - does anyone know of an app or similar that can ingest data the other direction of PagerDuty over to Splunk? Or do I need to create a customized script to accomplish this?

1 Solution

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

View solution in original post

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...