Set up Splunk Observability Cloud alerts in ITSI

Prerequisites

• You must set up Splunk Observability Cloud. For more information, see Get data into Splunk Observability Cloud.

Splunk Observability Cloud webhook setup

1. Create a new HEC token that you will use to set up the Observability webhook. For more information about configuring an HEC token in Splunk, see Set up and use HTTP Event Collector in Splunk Web in the Splunk Enterprise Getting Data In guide.
2. From Splunk Observability Cloud, select Data Management.
3. Select the Available integrations tab.
4. Select the Splunk platform tile.
5. Configure the connection using the HEC URL and token created in the first step.
6. The data is already formatted correctly for ITSI. Select Next.

Create a detector

1. In Splunk Observability, navigate to the Detectors & SLOs page.
2. Create a new detector that generates an alert for the metric that you want to measure. For more information about creating detectors, see [Create detectors to trigger alerts] in the Splunk Observability documentation.
3. Set the Alert recipient to Splunk platform.
4. Verify that alerts are sent to Splunk using HEC by running the search:
   

   index="*" sflo_dimensions