Has anyone set up automatic ingestion of PagerDuty Incident data into Splunk?

[briancronrath]

Wondering if anyone can suggest a good method of how to ingest PagerDuty incident data into splunk. Trying to leverage Splunk to create a dashboard showing who/which groups get paged and for what commons things they get paged for. It looks like the PagerDuty integration app only is a one way street of sending Splunk data over to PagerDuty - does anyone know of an app or similar that can ingest data the other direction of PagerDuty over to Splunk? Or do I need to create a customized script to accomplish this?

[davidpaper · Accepted solution]

It depends on which approach you want to take - pull the data or listen for the data?

1) Pull. Pagerduty has an API you can pull data from Documented on https://v1.developer.pagerduty.com/documentation/rest/incidents/list check it out!

2) Listen. This one to me is more interesting - it lets PD do the work. https://v1.developer.pagerduty.com/documentation/webhooks talks about it - and the output is JSON. This is idea for Splunk to accept via the HTTP Event Collector. I'm lazy, I'd use this before I'd spend the time to write my own REST call script.

-dave