Splunk Integration

Splunk is a platform for searching, monitoring, and analyzing machine data. This integration delivers triggered Splunk alerts to ITOC360 through the ITOC360 alert action app, so alerts fired by your saved searches open incidents on your dashboard and reach the right on-call engineer.

How it works

The ITOC360 app adds a custom alert action to Splunk. When a saved search or alert triggers, the action sends the alert to ITOC360 with the search name as its title, the host from the triggering result, and the severity you selected. ITOC360 maps the severity to a priority and routes the alert through your escalation policies.

Create a source in ITOC360

1. In ITOC360, go to Sources and click Add Source.

2. Select Splunk as the source type.

3. Give the source a name and save it.

4. Copy the generated source token — you will paste it into the alert action settings in Splunk.

Install the ITOC360 app in Splunk

Install from Splunkbase:

1. In Splunk Web, go to Apps → Find More Apps.

2. Search for ITOC360 and click Install.

Or install from file:

1. Download the app package from Splunkbase.

2. In Splunk Web, go to Apps → Manage Apps → Install app from file.

3. Upload the package and restart Splunk if prompted.

Add the alert action to an alert

1. Run the search you want to alert on, then click Save As → Alert. Give it a title, set the schedule (for example a cron schedule), and define the trigger condition.

1. Under Trigger Actions, click Add Actions and select ITOC360.

2. Configure the action:

Parameter	Description	Default
Source token	Token of your ITOC360 Splunk source	— (required)
Severity	Severity assigned to alerts from this action: critical, high, medium, or low	medium
Host field	Result field used as the alert host; falls back to the Splunk server name when missing	host

1. Click Save. The alert summary page shows ITOC360 listed under Actions.

Priority mapping

ITOC360 maps the severity you select to an alert priority:

Severity	ITOC360 priority
critical	CRITICAL
high	HIGH
medium	MEDIUM
low	LOW

Verify the integration

1. Create a test alert with a search that always returns results, for example index=_internal | head 5, scheduled to run every few minutes with a trigger condition of Number of Results > 0.

2. Attach the ITOC360 action with your source token.

3. When the alert triggers, it appears on your ITOC360 dashboard with the search name as its title.

4. If nothing arrives, search index=_internal itoc360 in Splunk — the action logs each delivery attempt and any errors there.