How can I identify a different way to send a Splunk alert in an external system?

[jip31]

Hi

I would like to identify the different way to send splunk results alert in Centreon.

I know its possible to send Centreon events in Splunk with the Centreon steamer connector and the Splunk HTTP Event Collector but my need will be to send Splunk alerts in Centreon

Except in i am mistaken, the solution to interface splunk alerts with an external system will be to run a custom alert action with script (shell or python) using the results of a saved search ?

Is it exact? Is there any other solutions to do that?

Thanks for your help

[gcusello · Accepted solution]

Hi @jip31 ,

I didn't tried to integrate Splunk with Centreon , so I hint to see is the "Centreon For Splunk" app has some feature to do this.

In  general, as you said, it's possible to run a script (in the language you prefer) that calls the Centreon API and send an alert to Centreon. 

Ciao.

Giuseppe

[jip31]

Hi Gcusello

Thanks for your answer

Concerning the "Centreon For Splunk" addon, I have installed it in my DEV environment

When I create an alert, I can see a trigger called "Centreon Service Submit Result"

Pearhaps, this service is able to send alerts in Centreon?

If yes, what are the different tasks to configure this addon in order to send alert in my centreon platform correctly?

Thanks

[gcusello]

Hi @jip31 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @jip31 ,

it seems that in the app there's an alert action to send logs to Centreon,

see in documentation how to configure it, I connot help you more in this.

Ciao.

Giuseppe