How to integrate Splunk with a ticketing system so if something fails, an alert triggers a webservice or email to generate a ticket?

[andybadera]

I have an enterprise app that of course does a lot of things. When some of these things fail, we want to either call a webservice, or possibly send an email, that generates a ticket within the IT ticketing system. (The webservice is definitely available; we're verifying whether or not email input is enabled for us.)

Are OOTB Splunk searches & alerts flexible enough to handle sending a customized email on their own, or do I need to look at a Splunk app, or possibly even polling the Splunk REST API?

The idea would be:
1. Splunk parses a log event of some type or within a specified ID range.
2. Splunk, a Splunk app, or an external app sends an email to the ticketing system that includes the body of the event, and possibly other details.

[javiergn]

Take a look at the following apps and posts:

• ServiceNow -> https://splunkbase.splunk.com/app/1770
• Jira -> https://splunkbase.splunk.com/app/2888
• http://wiki.splunk.com/Community:Use_Splunk_alerts_with_scripts_to_create_a_ticket_in_your_ticketing...
• https://answers.splunk.com/answers/24621/how-to-make-splunk-generate-a-help-ticket-or-bug-report-in-...
• https://answers.splunk.com/answers/248354/can-splunk-generate-a-comment-on-a-jira-ticket.html

[AndySplunks · Accepted solution]

OOTB Splunk searches should be able to handle it.

I've had Splunk generate emails with content in the body of the email or attached as a CSV and then have HP Service Manager parse the data for a support request.