Use the Notable Event Actions SDK

The Notable Events Action SDK comes packaged with ITSI and is located in $SPLUNK_HOME/etc/apps/SA-ITOA/lib/itsi/event_management/sdk. The SDK is implemented in Python and includes:

1. Methods for a Custom Action on an ITSI notable event: class CustomEventActionBase in custom_event_action_base.py
2. Methods for working on an ITSI notable event post-custom action: class Event in eventing.py
3. Methods for finding metadata for ITSI notable events: class EventMeta in eventing.py

Custom actions require a class that derives from CustomEventActionBase and implements the execute() method. The _init_() method of your class needs to initialize the base class CustomEventActionBase.

For more information, see the Notable events action SDK reference in this manual.

The following is a summary of the custom action Ping Host that ships with ITSI:

Because individual notable events are immutable in version 4.0.0 and later, you must pass the unique ID of an episode (itsi_group_id) instead of the ID of an individual notable event. Therefore, the previously event_id parameter is now itsi_group_id in the example below.

class Ping(CustomEventActionBase):
    def __init__(self, settings):
        # initialize CustomEventActionBase
        super(Ping, self).__init__(settings, self.logger)
   
    def get_host_to_ping(self):
       # from input settings, fetch host to ping
       # some logic is abstracted in custom_event_action_base.py
       ...
       return host

    def ping(self, host):
        #does the act of pinging the host
        ...
    def execute(self):
        # has all the logic of ping in here...
        host = self.get_host_to_ping()
        std_out, std_err = self.ping(host)
        
        # do other stuff here, like add a comment to an ITSI episode
        # or add a few tags, and so on....
        # change the state of the episode....
        for data in self.get_event():
            itsi_group_id = data.get('itsi_group_id')
            event = Event(self.get_session_key(), self.logger)
            event.create_comment(itsi_group_id, comment)
            event.create_comment(itsi_group_id, out)
            event.create_tag(itsi_group_id, 'ping')
        return

if __name__=='__main__':
    if len(sys.argv) > 1 and sys.argv[1] == '--execute':
        input_params = sys.stdin.read()
        ping = Ping(input_params)
        ping.execute()