All Apps and Add-ons

Has anyone set up automatic ingestion of PagerDuty Incident data into Splunk?

briancronrath
Contributor

Wondering if anyone can suggest a good method of how to ingest PagerDuty incident data into splunk. Trying to leverage Splunk to create a dashboard showing who/which groups get paged and for what commons things they get paged for. It looks like the PagerDuty integration app only is a one way street of sending Splunk data over to PagerDuty - does anyone know of an app or similar that can ingest data the other direction of PagerDuty over to Splunk? Or do I need to create a customized script to accomplish this?

1 Solution

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

View solution in original post

davidpaper
Contributor

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...