StatusHub Integration
Integrate Splunk On-Call & StatusHub for IT Incident Reports & Alerts
Splunk On-Call (Formerly VictorOps) is an incident management software that allows engineering and operations teams to work together, solve problems faster, and continuously improve in high-velocity deployment environments. StatusHub is built to communicate about issues to your users and customers. Linking these two systems allows your technical team to take advantage of automation and save valuable time. Their time is even more precious during unexpected IT outages.
About Splunk On-Call
Splunk On-Call provides a unified platform for real-time awareness, alerts, collaboration, and documentation. The company offers observability, collaboration, and timely alerts so you can build, deploy, and operate software fearlessly.
Overview of StatusHub and Splunk On-Call integration for IT Alerts & incident reports
Centralized Incident Management
Splunk On-Call serves as a hub for centralizing the flow of information throughout the incident lifecycle. It aggregates data from multiple monitoring tools, ensuring that all relevant information is available in one place. StatusHub establishes a secure connection between your Splunk On-Call and StatusHub accounts. This integration allows incident information identified by Splunk On-Call to be seamlessly transferred to StatusHub, improving system management. This integration of both platforms helps your organization handle any IT issues efficiently and effectively without worrying about answering customer inquiries.
Automated Incident Reporting
When Splunk On-Call identifies an issue in your system, it will send the information to your StatusHub. When StatusHub detects an issue it automatically creates an incident report and posts it to your StatusHub account. This automation saves your technical team valuable time and resources, allowing them to focus on investigating and resolving the problem quickly. Additionally, customers and users are informed immediately, ensuring transparency and reducing the impact of issues.
Technical Overview of Splunk On-Call Integration with StatusHub
Because Splunk On-Call integration is done through a URL with a service token, it’s a one-to-many association. A single Splunk On-Call webhook can’t create incidents on multiple StatusHub services.
Splunk On-Call integration can only create incidents in StatusHub. It can’t create maintenance event.
The initial StatusHub incident status will always be “investigating”.
When the issue is resolved, Splunk On-Call will close the incident in StatusHub by setting incident status to “resolved”.
Service statuses will be set based on “ALERT.alerttype” or “alerttype” parameters sent by Splunk On-Call. Value mapping is as follows: CRITICAL -> “red” WARNING -> “yellow” RECOVERY -> “green”
The incident title will be set to either the “ALERT.entitydisplayname” or “entitydisplayname” parameter from the Splunk On-Call payload
The incident update message will be set to either the “ALERT.statemessage” or “statemessage” parameter from the Splunk On-Call payload,
Please note that because this integration use Splunk On-Call Transmogrifier, it will not work with manually created incidents or incidents created via Splunk On-Call General API as those will not trigger Splunk On-Call Transmogrifier processing. Example of integration that works is for example REST Integration