Create Muting Rules via REST API

[MichaelB]

I'm working to try and automate the creation of muting rules for our maintenance windows, I've been looking around to see if there is a way to use the API to create a muting rule, but I'm not finding anything, does this not exist?

Is there an existing integration with Service-Now that would do this that I'm just not finding? I'm hoping to tie into our change management system to have these muting windows created automatically upon approval. 

[livehybrid · Accepted solution]

Here’s a sample curl request to create a muting rule in the Splunk Observability Suite using the provided API reference:

curl -X POST "https://api.us0.signalfx.com/v2/incidents/muting-rules" \
     -H "Content-Type: application/json" \
     -H "X-SF-TOKEN: YOUR_ACCESS_TOKEN" \
     -d '{
           "filter": {
             "severity": "Warning",
             "incidentType": "SIGNAL",
             "tags": {
               "environment": ["prod"],
               "team": ["infra"]
             }
           },
           "reason": "Scheduled maintenance",
           "startTime": 1672531200000,
           "endTime": 1672617600000,
           "enabled": true
         }'

Explanation:

• URL: The API endpoint to create muting rules.
• Headers:
  • Content-Type: application/json: Specifies JSON payload.
  • X-SF-TOKEN: Your Splunk Observability API token.
• Payload:
  • filter: Defines what incidents to mute based on severity, type, and tags.
  • reason: Explanation for the muting rule (e.g., scheduled maintenance).
  • startTime and endTime: Unix epoch time (in milliseconds) specifying when the rule will be active.
  • enabled: Boolean to activate the muting rule immediately.

Replace YOUR_ACCESS_TOKEN and customize the payload as needed for your setup. Refer to the Splunk Observability API docs for further customization options.

Please let me know how you get on and consider upvoting/karma this answer if it has helped.
Regards

Will

[bishida]

Is it this one?

https://dev.splunk.com/observability/reference/api/incidents/latest#endpoint-create-single-muting-ru...