PagerDuty >> Splunk

[swn.grnvld]

Good morning all and happy Wednesday!

Normally the question is about Splunk sending events towards PagerDuty, however in this case we would like to have audit (log) data AND incident metadata into Splunk.

Reason being for point 1 is obvious, for point 2 is for the fact that we provide metrics to our Executives through Splunk.

Thank you for your thoughts!

Swn

[Inactive-Member-27144877]

Hello Swn,

John here from the Pagerduty support team, thanks for reaching out on our community page. Our Splunk integration is only one way at the moment, but Id love to know more about your use case we can then share it with our product team and let them know what you are looking for.

Thanks!
John

[dmcclure (Doug McClure)]

You can certainly poll the PD Audit API to pull that data over into Splunk, or use some other integration middleware approach to collect and push into Splunk’s APIs. Check out these links for some ideas:

• Add On Builder: https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/ConfigureDataCollection
• REST API Poller: https://splunkbase.splunk.com/app/1546/
• Here’s an example of getting Audit API data and sending it into Sumo Logic that might give you some ideas on what you might do with Splunk. https://github.com/PagerDuty-Samples/lambda-audit-records-to-sumo-logic

Let us know what you come up with and share!