> For the complete documentation index, see [llms.txt](https://docs.itoc360.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.itoc360.com/integrations/inbound-integrations/log-management/splunk-integration.md).
# Splunk Integration
Splunk is a platform for searching, monitoring, and analyzing machine data. This integration delivers triggered Splunk alerts to ITOC360 through the ITOC360 alert action app, so alerts fired by your saved searches open incidents on your dashboard and reach the right on-call engineer.
### How it works
The ITOC360 app adds a custom alert action to Splunk. When a saved search or alert triggers, the action sends the alert to ITOC360 with the search name as its title, the host from the triggering result, and the severity you selected. ITOC360 maps the severity to a priority and routes the alert through your escalation policies.
### Create a source in ITOC360
1. In ITOC360, go to **Sources** and click **Add Source**.
2. Select **Splunk** as the source type.
3. Give the source a name and save it.
4. Copy the generated source token — you will paste it into the alert action settings in Splunk.
### Install the ITOC360 app in Splunk
Install from Splunkbase:
1. In Splunk Web, go to **Apps → Find More Apps**.
2. Search for **ITOC360** and click **Install**.
Or install from file:
1. Download the app package from Splunkbase.
2. In Splunk Web, go to **Apps → Manage Apps → Install app from file**.
3. Upload the package and restart Splunk if prompted.
### Add the alert action to an alert
1. Run the search you want to alert on, then click **Save As → Alert**. Give it a title, set the schedule (for example a cron schedule), and define the trigger condition.
1. Under **Trigger Actions**, click **Add Actions** and select **ITOC360**.
2. Configure the action:
| Parameter | Description | Default |
| ------------ | -------------------------------------------------------------------------------------- | ------------ |
| Source token | Token of your ITOC360 Splunk source | — (required) |
| Severity | Severity assigned to alerts from this action: critical, high, medium, or low | medium |
| Host field | Result field used as the alert host; falls back to the Splunk server name when missing | host |
4. Click **Save**. The alert summary page shows ITOC360 listed under Actions.
### Priority mapping
ITOC360 maps the severity you select to an alert priority:
| Severity | ITOC360 priority |
| -------- | ---------------- |
| critical | CRITICAL |
| high | HIGH |
| medium | MEDIUM |
| low | LOW |
### Verify the integration
1. Create a test alert with a search that always returns results, for example `index=_internal | head 5`, scheduled to run every few minutes with a trigger condition of **Number of Results > 0**.
2. Attach the ITOC360 action with your source token.
3. When the alert triggers, it appears on your ITOC360 dashboard with the search name as its title.
4. If nothing arrives, search `index=_internal itoc360` in Splunk — the action logs each delivery attempt and any errors there.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.itoc360.com/integrations/inbound-integrations/log-management/splunk-integration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.