Splunk Integration
Send Splunk log or search‑based alerts to ilert, enabling on‑call engineers to react quickly to critical events uncovered in your data.
The Splunk integration captures alerts from scheduled searches or log monitors and delivers them to on-call responders via ilert. By forwarding relevant technical alerts, your team can rapidly investigate critical events and reduce time to resolution based on log context.
In ilert: Create a Splunk alert source
Go to Alerting → Alert sources and click Create new alert source.
Search for Splunk, click its tile, and click Next.
Give your alert source a name, optionally assign teams, and click Next.
Choose who gets notified: select Use existing escalation policy and pick a policy, or Generate new escalation policy to start with a basic one that notifies you first. Click Next.
Pick an existing escalation policy, or generate a basic one without leaving the wizard. Select Default grouping and click Continue setup. It groups events by the alert key the integration sets; the other grouping options are easier to judge once events are arriving.
The next page shows more settings, such as notification priority and alert templates. Click Finish setup for now; you can change them later.
On the final page, ilert shows the integration key and URL for this alert source. You will need them later in this guide.
In Splunk: Create a search
Go to Splunk and then to Search & Reporting. Create a search for which you'd like to create an alert.
Click on Save As and then on Alert to add an alert
On the modal window name the alert e.g. iLert, choose Webhook in the When triggered section and **paste the Webhook URL that you generated in ilert and click on Save**
Finished! Your Splunk alerts will now create alerts in ilert.
FAQ
Will alerts in ilert be resolved automatically?
No, unfortunately Splunk alerts do not fire resolve events.
Can I connect Splunk with multiple alert sources from ilert?
Yes, simply create more action sequences in Splunk.
Last updated
Was this helpful?