Skip to main content

 

Splunk Lantern

Sending Splunk Observability events as Alert Actions from Splunk Cloud

 

It can be helpful for Splunk Observability Cloud users to be identified of issues in Splunk Cloud Platform, even if they don't have access to use Splunk Cloud Platform. A Splunk Observability Cloud Alert Action can be used to send those users a notification. For example, Splunk Observability Cloud users might need to be aware of events in security indexes that are alerted on in Splunk Cloud Platform. A Splunk Observability Cloud Alert Action can send your developers a notification that a vulnerability has been identified in their code.

Similar context sharing can be applied to any data within Splunk, including Splunk ITSI or other Splunk app data. Other common use cases may include:

  • CI/CD deployments and status
  • Rare but important error exceptions
  • Notifying developers in Splunk Observability Cloud of outages in on-premises infrastructure
  • Any other issues monitored by Splunk that may impede development work

To enable this information sharing, you want to be able to pass context from Splunk Cloud Platform to Splunk Observability Cloud. 

  1. Download the Splunk Observability Cloud Alert Action for Splunk from Splunkbase.
  2. From the Apps drop-down menu, select Splunk Observability Cloud Alert Action for Splunk, then click on Configuration.
  3. Enter your Splunk Observability Cloud API token.

  1. Create and schedule your alert as normal. Here is an example of the alert setup:

  1. At the bottom of your alert setup, there is the option to Add Actions for the alert to undertake when it fires. Choose the Observability Events Alert Action.

  1. Input the fields you would like to pass as dimensions into Splunk Observability Events.

  1. In Splunk Observability Cloud, open the dashboard that you'd like to overlay event data on.
  2. In the Event Overlay drop-down, choose an Event Overlay to match your event name. You can use asterisks (*) to work as wildcards.

 

  1. In your chart options, enable Show events as lines and Show data markers for overlaying events on that chart.

Events will now be overlaid on your chart.

Next steps

These resources might help you understand and implement this guidance:

Still need help with this use case? Most customers have OnDemand Services per their license support plan. Engage the ODS team at OnDemand-Inquires@splunk.com if you require assistance.