Splunk Integration - Event Routing from Splunk

#1

Hi all,

I have installed the PagerDuty App on Splunk and configured an integration on a specific service but the alerts aren’t flowing yet.

When creating an alert in splunk and selecting the pagerduty option, I entered the following as the optional Integration URL: https://events.pagerduty.com/integration/IntegrationKey/enqueue

The integration guide for Splunk doesn’t make it clear if the url requires the /enqueue value or not.

The error on splunk is showing as below which we aren’t quite sure what this error means as it seems related.
Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf, line 3: param.integration_url (value: https://events.pagerduty.com/integration/IntegrationKey/enqueue

Note: I replaced the actual integration key from the service with the word IntegrationKey
I didn’t want to use the global routing key in this instance and send the alert directly to the specific service.

Can the experts please provide their thoughts on this.

Kind Regards,
Aron

#2

Hi @ing-acampbel,

You should be entering the actual integration key associated with e service you want to integrate Splunk with.
Once you have made the change and the issue still persists, please email support@pagerduty.com referencing this post. We would require details specific to your account to troubleshoot then and would not want them posted here.
If you do need to email the PagerDuty Support Team, you would need to provide the name or link to the Service in question and the time in UTC when an attempt was made to trigger an Incident.

Cheers