Skip to main content
Sync Splunk alert events to Flashduty through webhook for automated alert noise reduction.

​
In Flashduty

You can get the integration push URL in either of the following ways.

​
Use a dedicated integration

Choose this option if all alerts go to one channel. It’s the simpler setup.
  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add an integration
  3. Choose Splunk integration and click Save to generate a card
  4. Open the generated integration card and copy the Push URL

​
Use a shared integration

Choose this option if you need to route alerts to different channels based on the alert payload.
  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Splunk integration:
    • Integration Name: Define a name for this integration
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

​
In Splunk

  1. Log in to your Splunk console
  2. In the Search and Report application, search for keywords you want to monitor, such as “error”
  3. In the upper right corner’s save menu, select Alerts to configure the search keywords as monitoring items drawing
  4. In the configuration popup, enter relevant information. Configure the set up and Triggering conditions sections according to your needs
  5. In the Trigger Action section, click Add Action and select Webhook drawing
  6. In the Webhook section, enter the integration push URL in the URL field (the URL will be generated after saving the integration name on the current page) and save to complete the alert configuration
drawing

​
Status mapping

Since Splunk alert events don’t differentiate severity levels, all alert events pushed from Splunk to Flashduty will have a Warning status and won’t include recovery events.