
Set up custom episode actions in ITSI
Episode actions have the same prerequisites as custom alert actions in Splunk Enterprise. See Custom alert actions overview in Developing Views and Apps for Splunk Web.
- Create a local version of
SPLUNK_HOME/etc/apps/SA-ITOA/default/notable_event_actions.conf
. - Add a stanza for the action you want to perform. For example:
[itsi_sample_event_action_ping]
- Set
disabled=0
to enable the custom action.
For example:
[itsi_sample_event_action_ping] disabled = 0
Setting up custom alert actions via notable_event_actions.conf only allows for a one-way integration. The episode will not contain a drilldown link to the action that was performed.
PREVIOUS Manage notable event indexes in ITSI |
NEXT Tune notable event grouping in ITSI |
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5
Feedback submitted, thanks!