Use custom streaming commands for the Splunk Add-on for BMC Remedy
The Splunk Add-on for Remedy includes four custom centralized streaming commands that let you create and update incidents:
remedyincidentcreatestream
remedyincidentupdatestream
remedyincidentcreatestreamrest
remedyincidentupdatestreamrest
When you pipe events to one of these streaming commands, the streaming command reads the piped events and then creates or updates incidents automatically in Remedy.
Before you can use these commands, set up the Splunk Add-on for BMC Remedy and update the required fields in the remedy_fields.conf
file to match the required fields in your Remedy installation.
remedyincidentcreatestream
streaming command
Like the remedyincidentcreate
custom generating search command, the remedyincidentcreatestream
streaming command lets you create incidents in Remedy, provided that you include the required arguments. The required arguments are listed in the [create_incident]
stanza of the remedy_fields.conf
file. See Specify required fields for incidents for information.
Because Remedy is highly customizable, when you run an incident create or update command from the Splunk platform, some fields in your Remedy incident may be populated based on form definitions and business rules set up in your Remedy system rather than the arguments supplied with the command.
To add any custom fields for incident creation as per the BMC Remedy ITSM setup, you must pass it as an argument in the | remedyincidentcreatestream
command. Make sure fields are configured in your BMC environment and are present in WSDL.
Unlike the custom generating search commands, searches using the custom streaming search commands may create multiple incidents in Remedy. This occurs if the search string that you include before the streaming command returns multiple events. The number of events returned by a search that includes one of these streaming search commands equals the number of incidents created in Remedy.
The following example search creates an incident when CPU usage is more than 95:
sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | eval First_Name="Mary" | eval Last_Name="Mann" | eval Impact="1-Extensive/Widespread" | eval Reported_Source="Fax" | eval Service_Type="User Service Restoration" | eval Status="Assigned" | eval Urgency="1-Critical" | eval Summary="CPU on ". host ." is at ". CPU | eval Custom_Test_Field="Test field" | remedyincidentcreatestream
remedyincidentupdatestream
streaming command
Like the remedyincidentupdate
custom generating search command, the remedyincidentupdatestream
streaming command lets you update incidents in Remedy, provided that you include the required arguments. The required arguments are listed in the [update_incident]
stanza of the remedy_fields.conf
file. See Specify required fields for incidents for information.
Because Remedy is highly customizable, when you run an incident create or update command from the Splunk platform, some fields in your Remedy incident may be populated based on form definitions and business rules set up in your Remedy system rather than the arguments supplied with the command.
To add any custom fields for incident updation as per the BMC Remedy ITSM setup, you must pass it as an argument in | remedyincidentupdatestream
command. Make sure fields are configured in your BMC environment and must be present in WSDL.
You can use the custom streaming command to update incidents only if they were created from the Splunk platform.
The following example search updates an incident when CPU usage is more than 95:
sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | | eval Incident_Number="INC000000000001" | eval Status="Assigned"| eval Summary="CPU on ". host ." is at ". CPU | eval Custom_Test_Field="Test field updated" | remedyincidentupdatestream
remedyincidentcreatestreamrest
streaming command
Like the remedyincidentcreaterest
custom generating search command, the remedyincidentcreatestreamrest
streaming command lets you create incidents in Remedy, provided that you include the required arguments. The required arguments are listed in the [create_incident_rest]
stanza of the remedy_fields.conf
file. See Specify required fields for incidents for information.
Because Remedy is highly customizable, when you run an incident create or update command from the Splunk platform, some fields in your Remedy incident may be populated based on form definitions and business rules set up in your Remedy system rather than the arguments supplied with the command.
To use the custom fields in this command, you have to pass || separated key-value pairs of custom fields and values as part of --custom_fields argument in the command. All the parameters which are passed in the --custom_fields are needed to be configured first in the BMC Remedy instance. Parameters passed in custom fields must be present in BMC Remedy incident form.
There is a restriction on which fields can be provided directly. The fields which can be provided directly can be found here. In addition to the fields mentioned in the list, others need to be provided in the custom fields parameter.
Unlike the custom generating search commands, searches using the custom streaming search commands may create multiple incidents in Remedy. This occurs if the search string that you include before the streaming command returns multiple events. The number of events returned by a search that includes one of these streaming search commands equals the number of incidents created in Remedy.
Make sure you pass the --account parameter, and with value as name of account configured on Rest Account page.
The following example search creates an incident when CPU usage is more than 95:
sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | eval First_Name="Mary" | eval Last_Name="Mann" | eval Impact="1-Extensive/Widespread" | eval Status="Assigned" | eval Urgency="1-Critical" | eval Description="CPU on ". host ." is at ". CPU | eval account = "Account_1" | eval custom_fields "customfield1=value1||customfield2=value2" | remedyincidentcreatestreamrest
remedyincidentupdatestreamrest
streaming command
Like the remedyincidentupdaterest
custom generating search command, the remedyincidentupdatestreamrest
streaming command lets you create incidents in Remedy, provided that you include the required arguments. The required arguments are listed in the [update_incident_rest]
stanza of the remedy_fields.conf
file. See Specify required fields for incidents for information.
Because Remedy is highly customizable, when you run an incident create or update command from the Splunk platform, some fields in your Remedy incident may be populated based on form definitions and business rules set up in your Remedy system rather than the arguments supplied with the command.
To use the custom fields in this command, you have to pass || separated key-value pairs of custom fields and values as part of --custom_fields argument in the command. All the parameters which are passed in the --custom_fields are needed to be configured first in the BMC Remedy instance. Parameters passed in custom fields must be present in BMC Remedy incident form.
There is a restriction on which fields can be provided directly. The fields which can be provided directly can be found here. In addition to the fields mentioned in the list, others need to be provided in the custom fields parameter.
Unlike the custom generating search commands, searches using the custom streaming search commands may create multiple incidents in Remedy. This occurs if the search string that you include before the streaming command returns multiple events. The number of events returned by a search that includes one of these streaming search commands equals the number of incidents created in Remedy.
Make sure you pass the --account parameter, and with value as name of account configured on Rest Account page.
The following example search creates an incident when CPU usage is more than 95:
sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | eval "Incident Number"="INC000000014106" | eval Status="Assigned" | eval Description="CPU on ". host ." is at ". CPU | eval account = "Account_1" | eval custom_fields "customfield1=value1||customfield2=value2" | remedyincidentupdatestreamrest
Use custom search commands for the Splunk Add-on for BMC Remedy | Use the custom Remedy Incident Integration alert actions in the Splunk Add-on for BMC Remedy Using SOAP API |
This documentation applies to the following versions of Splunk® Supported Add-ons: released, released
Feedback submitted, thanks!