Set up custom episode actions in ITSI
Episode actions have the same prerequisites as custom alert actions in Splunk Enterprise. See Custom alert actions overview in Developing Views and Apps for Splunk Web.
- Create a local version of
- Add a stanza for the action you want to perform. For example:
disabled=0to enable the custom action.
[itsi_sample_event_action_ping] disabled = 0
Setting up custom alert actions via notable_event_actions.conf only allows for a one-way integration. The episode will not contain a drilldown link to the action that was performed.
Manage notable event indexes in ITSI
Tune notable event grouping in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.1.2, 4.1.5