Skip to content
downpipes docs

Send downpipes alerts to Splunk On-Call

Splunk On-Call (formerly VictorOps, now under Splunk and Cisco) receives downpipes alerts through a REST endpoint integration. There is no dedicated Splunk On-Call channel here; instead you add a generic webhook channel and map downpipes’ event JSON to Splunk On-Call’s fields with a documented recipe.

What you need

  • A Splunk On-Call account where you can add a REST endpoint integration and copy its notify URL.
  • Access to the downpipes console with the notify-config capability (Operator, Approver or Owner) to add and test the channel.

Set it up

  1. In Splunk On-Call, add a REST endpoint integration and copy the notify URL it gives you.
  2. In the downpipes console, open Notifications, choose Add a channel and pick Webhook (generic HTTPS POST). Adding a channel needs the notify-config capability, so an Operator, Approver or Owner can add one.
  3. Paste the notify URL into the HTTPS URL field. It must be https and carry no embedded credentials. Name the channel and save it, then a rule routes events to it.
  4. In Splunk On-Call, set up the mapping that turns downpipes’ event JSON into Splunk On-Call’s fields. downpipes posts a downpipe-event-v1 body with the event name, the severity, the downpipe id and name, and a one-line detail.
  5. Map message_type from the event and severity (Splunk On-Call reads CRITICAL, WARNING, ACKNOWLEDGEMENT, INFO and RECOVERY), and set entity_id from a stable field such as the downpipe id so every event for one downpipe lands on the same incident.
  6. Choose Test on the channel to confirm delivery without sending real alert content, then check the incident arrived in Splunk On-Call.

Good to know

  • entity_id is what ties an incident together. Splunk On-Call resolves an incident when it receives a RECOVERY on the same entity_id, so keep entity_id constant across the incident’s life. Derive it from the downpipe id and a later recovery for that downpipe resolves the incident it opened.
  • The resolve lives in your recipe, not in downpipes. Unlike the PagerDuty, Jira Service Management and ServiceNow channels, downpipes sends no dedicated resolve here. The generic webhook posts the same event shape every time, and your Splunk On-Call mapping is what reads a recovery and closes the incident. Confirm the current field names in the Splunk On-Call console, because the mapping is theirs to define.

Last updated .