*Version: 1.0 | Last Updated: 19/02/2025*
## Overview
- **Integration Name:** Splunk
- **Purpose:** Integrate Splunk with Moovingon AI, enabling users to receive Splunk notifications
- **Prerequisites:**
- A valid Splunk account
- MoovingON AI account access with integration permissions
---
## Table of Contents
- [[#Setup Instructions]]
- [[#Configuration]]
- [[#Related Links]]
---
## Setup Instructions
1. Step 1: In MoovingON AI, navigate to Settings -> Integrations.
2. Step 2: On the right side of the page, select "Add Webhook."
3. Step 3: Enter an integration name for the webhook and click "Submit."
4. Step 4: A webhook basic authentication (Username and Token) will be created after submission.
****
- Save the generated Username and Token for use in Splunk
---
## Configuration
Step 1: Create a New Search Query for Alerts
- Open Splunk Web Interface.
- Navigate to Search & Reporting.
- Enter your search query to detect relevant events (For example
index=apache_logs error ).
Step 2: Click Save As → Alert.
Step 3: Configure the Alert Conditions
This Splunk alert configuration page allows you to set up a scheduled or real-time alert that triggers actions (e.g., webhooks, emails) when specific search conditions are met. Below is a breakdown of each setting and how to configure it.
Click + Add Actions to define what happens when the alert triggers.
Available options:
1. Webhook (send data to an external API).
2. Email Notification (send an email when triggered).
3. Run a Script (execute a custom script for automation).
4. Log Event (write the alert to an internal Splunk index).
Step 4: Configure the Webhook URL
In the Webhook Action settings, enter the API URL,
Need to configure the Webhook Headers, since Splunk UI does not provide a direct way to set headers, you need to configure them by using the .conf file that is located into the directory of the Splunk directory.
This is an example of a .conf file.
Here, we can configure all the actions that are related to each alert.
---
## Related Links
- **External Resources:** [Splunk Documentation](https://docs.splunk.com/Documentation)