Send downpipes alerts to Splunk On-Call
Splunk On-Call (formerly VictorOps, now under Splunk and Cisco) receives downpipes alerts through a REST endpoint integration. There is no dedicated Splunk On-Call channel here; instead you add a generic webhook channel and map downpipes’ event JSON to Splunk On-Call’s fields with a documented recipe.
What you need
- A Splunk On-Call account where you can add a REST endpoint integration and copy its notify URL.
- Access to the downpipes console with permission to configure notifications (Operator, Approver or Owner) to add and test the channel.
Set it up
- In Splunk On-Call, add a REST endpoint integration and copy the notify URL it gives you.
- In the downpipes console, open Notifications, choose Add a channel and pick Webhook (generic HTTPS POST). Adding a channel needs permission to configure notifications, so an Operator, Approver or Owner can add one.
- Paste the notify URL into the HTTPS URL field. It must be https and carry no embedded credentials. Name the channel and save it, then a rule routes events to it.
- In Splunk On-Call, set up the mapping that turns downpipes’ event JSON into Splunk On-Call’s fields. downpipes posts a
downpipe-event-v1body with the event name, the severity, the downpipe id and name, and a one-line detail. - Set
entity_idfromdedupKeyso every event for one downpipe and event lands on the same incident. An account-level event has one key for each event name, so repeated alerts of one account-level event group onto one open alert, and no recovery closes it. Mapmessage_typetoRECOVERYwhen the body carriesrecovered: true, and from the severity in all other cases (Splunk On-Call readsCRITICAL,WARNING,ACKNOWLEDGEMENT,INFOandRECOVERY). Read the note below for engines before 0.3.6. - Choose Test on the channel to confirm delivery without sending real alert content, then check the incident arrived in Splunk On-Call.
Good to know
- entity_id is what ties an incident together. Splunk On-Call resolves an incident when it receives a
RECOVERYon the sameentity_id, so keepentity_idconstant across the incident’s life. From engine 0.3.6,dedupKeyis the same on a trigger and on the recovery that clears it, so mapentity_idfrom it. Before engine 0.3.6, derive it from the downpipe id. recoveredtells your recipe to emitRECOVERY. From engine 0.3.6, a recovery carriesrecovered: true. Do not keyRECOVERYoneventorseverity: a recovery reuses the sameeventname and the sameseverityas the trigger it clears, so a recipe keyed on those fields reads it as another firing and keeps the incident open. Before engine 0.3.6, the body has norecoveredfield, and only thedetailwording tells a recovery from a trigger. The canary stream names its recovery in the event field ascanary-recoveredon every version. That event carries norecoveredfield, and itsdedupKeyisaccount:canary-recovered, not the key of thecanary-deadalert. So this mapping does not close acanary-deadalert. Close it by hand. Confirm the current field names in the Splunk On-Call console too, because the mapping is theirs to define. When you do not want to maintain a mapping, route to the PagerDuty, Jira Service Management / Opsgenie or ServiceNow channel alongside Splunk On-Call: each of those sends a real resolve, close-by-alias or severity-0 clear on recovery with no mapping from you.
Last updated .