Splunk Observability Cloud Alert Action for Splunk

[mnegron1]

The "Splunk Observability Cloud Alert Action for Splunk "  install does not make a reference to adding an observability API Token; however, when testing, the event fails with this error on the _internal log:  observability_api_token is a mandatory setup parameter, but its value is None.

Where is this token defined?

[livehybrid]

Hi @mnegron1 

The Splunkbase app page shows the following instructions:

• Click the "Apps" drop down and select "Splunk Observability Events" to configure your Splunk Observability API Token.
  • Note: Make sure you are using an Ingest token and not a personal API token.

Although Ive tested this and it takes you to an empty dashboard. You need to navigate to

https://yourSplunkInstance/en-US/app/TA-splunk-observability-events/configuration

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing