The Splunk integration enables you to trigger workflows with Splunk alerts to perform searches and create alerts as part of a workflow.
Use Splunk to Trigger Torq Workflows
To ingest Splunk Enterprise alerts as events in Torq, you must create a generic Webhook integration in Torq and use the generated webhook URL (Torq endpoint) to configure an alert in Splunk. The alert data is sent via the webhook to Torq as a trigger event.
Configure a Webhook Integration in Torq
Go to Build > Integrations > Triggers > Webhook and click Add.
Type a meaningful name for the integration instance, for example, Splunk-Receiver, and click Add.
Locate the integration and copy the URL link. You will need this when you create the alert in Splunk.
Create an Alert in Splunk
To create an alert, you'll define and run a Splunk query and save that query as an alert. This alert will be sent via webhook to Torq as a trigger event, either in real time or on a schedule.
By default, real-time alerts in Splunk Cloud is disabled. You need to contact Splunk to enable the feature. Splunk Cloud also supports sending alerts on a schedule.
Go to your Splunk homepage and click Search & Reporting.
Enter a search query in the search bar and run the search. For this example, we'll use the search query
source="udp:514" sourcetype="syslog".Save the search as an alert.
Fill in the save alert form.
Enter a meaningful title, for example, Send alerts to Torq.
In the Trigger Actions section, click Add Actions and select Webhook.
Enter the Splunk webhook URL (Torq endpoint) you created earlier and click Save.
Use Splunk Steps in a Torq Workflow
To use Splunk steps in Torq workflows, you must create a Splunk steps integration, which requires a Splunk Enterprise API token.
After you create the token, it will appear in the Token field. Ensure you copy it because it will not be accessible after you close the window.
Create a Splunk API Token
For more information about Splunk tokens, see the Splunk documentation.
Sign in to your Splunk tenant.
Click Settings > Tokens. If this is your first time using tokens, you might have to enable token authentication.
Click New Token and configure the token parameters and then click Create. In our example, the token will expire in 30 days.
Create a Splunk Enterprise Integration in Torq
Go to Build > Integrations > Steps > Splunk and click Add.
Type a meaningful name for the integration instance. This cannot be changed later.
Enter the API token that you generated in your Splunk tenant.
Enter the URL of your Splunk tenant (including port).
Click Add.