Integrate with Splunk IT Service Intelligence

Splunk ITSI has a notable event functionality to create alerts or trigger a script. Use Splunk ITSI alerts to monitor for and respond to specific events. Alerts use a saved search to look for events in real time or on a schedule. Alerts are triggered when search results meet specific conditions. Alert actions can be used to respond when alerts trigger.

What does the integration offer?

Splunk IT Service Intelligence's easily sift through vast amounts of events by filtering and sorting them based on priority. Additionally, Splunk ITSI triggers alerts, initiates remediation, and automates incident workflows. Real-time anomaly detection also reduces alert fatigue. Through Jira Service Management for Splunk ITSI app, forward Splunk ITSI alerts to Jira Service Management. With the Splunk ITSI Integration, Jira Service Management acts as a dispatcher for these alerts, determines the right people to notify based on on-call schedules– notifies via email, text messages (SMS), phone calls, and iPhone & Android push notifications, and escalates alerts until the alert is acknowledged or closed.

How does the integration work?

Jira Service Management has a Splunk ITSI specific alert app to send Splunk ITSI alerts to Jira Service Management. Jira Service Management also has a specific API for Splunk ITSI Integration, Splunk ITSI sends alerts through Jira Service Management for Splunk ITSI app to Jira Service Management and Jira Service Management handles the automatic creation of alerts.

Set up the integration

Splunk ITSI is a bidirectional integration. Setting it up involves the following steps:

• Add a Splunk ITSI integration in Jira Service Management

• Configure the integration in Splunk ITSI

Add a Splunk ITSI integration

To add a Splunk ITSI integration in Jira Service Management, complete the following steps:

1. Go to your team’s operations page.

2. On the left navigation panel, select Integrations and then Add integration.

3. Run a search and select “Splunk ITSI”.

4. On the next screen, enter a name for the integration.

5. Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.

6. Select Continue.
   The integration is saved at this point.

7. Expand the Steps to configure the integration section and copy the API URL.
   You will use this key while configuring the integration in Splunk ITSI later.

8. Select Turn on integration.
   The rules you create for the integration will work only if you turn on the integration.

Configure the integration in Splunk ITSI

To configure the integration of Splunk ITSI with Jira Service Management, complete the following steps:

1. In Splunk, install the Jira Service Management for Splunk ITSI app from Splunkbase.

2. Go to your apps and select Set Up to configure the Jira Service Management app.

3. Select the notable event for which you want to create an alert.

4. Select Jira Service Management Manage Event with Jira Service Management from Actions.

5. Paste the API URL previously copied from Jira Service Management into JSM API URL.

6. Set the priority.

7. Select Done.

Update the API URL

Update the default API URL and priority in alert_actions.conf for $SPLUNK_HOME/etc/apps/jsm_itsi/default.

Review the app logs

If any problems occur while creating an alert at Jira Service Management, check the app logs in $SPLUNK_HOME/var/log/splunk/jsm_itsi.log.

Create alerts in Notable Events Review

1. In IT Service Intelligence, go to the Notable Events Review page.

2. Select on a Notable Event to create an alert.

3. Select Actions > Manage Event with Jira Service Management.

Create automatized alerts using Notable Event Aggregation Policies

1. Select Configure > Notable Event Aggregation Policies.

2. Create a New Notable Event Aggregation Policy or edit an existing one.

3. In the Action Rules tab, add a Rule and update action to "Manage Event with Jira Service Management".

4. Select Configure and use the API URL copied previously and select the priority.

5. Click Save.

Map alert actions

Jira Service Management allows you to map alert actions between Jira Service Management actions and Splunk ITSI.

For alerts created by Splunk ITSI

• Use this section to map Jira Service Management actions to Splunk ITSI actions when the source of the alert is Splunk ITSI (i.e When the alert is created by Splunk ITSI integration.)

• Map different Jira Service Management actions to different Splunk ITSI actions. For example, set the Notable Event status to "In Progress" in Splunk ITSI, when the alert is acknowledged. In order to do this, define "If alert is acknowledged in Jira Service Management", "update Notable Event Status to In Progress" mapping in the "Send Alert Updates Back to Splunk ITSI" section.

After the update action is triggered in Jira Service Management, updates are sent back to the Notable Event and updates are viewed from the "Activity" tab.

Sample payload sent from Splunk and dynamic properties in Jira Service Management

Create Alert payload

JSON