Set up Oracle Enterprise Manager alerts in ITSI

Ingest alerts from Oracle Enterprise Manager (OEM) into Splunk ITSI.

Prerequisites

  • OEM 24ai (24.1.0.0.0) with sysman-equivalent privileges to create Notification Methods and Incident Rules

  • A Splunk HEC endpoint reachable from the OMS host (for example, https://<splunk-host>:8088/services/collector)

  • Splunk admin access to configure HEC tokens

Create a Splunk HEC token

  1. Log in to Splunk.

  2. Navigate to Settings, then Data Inputs, then HTTP Event Collector.

  3. Select New Token. Add a name for your token.

  4. On the Input Settings page:

    1. Set Source type to oem:alert.

    2. Select an Index. Select Review, then Submit. Copy the generated token value.

OEM webhook setup

  1. Log in to OEM as sysman (or a user with Manage Notification Methods privilege).

  2. Navigate to Setup then Notifications then Webhooks and Slack.

  3. Select Add Notification Method. From the Applies to drop-down list, select Incidents and set the type to Webhook. Fill in the following fields:

    1. Name: Send to Splunk HEC

    2. URL: https://<splunk-host>:8088/services/collector

    3. HTTP Method: POST

  4. Add the request header Authorization with the value Splunk <your-hec-token>. Replace <your-hec-token> with the token value from Step 1.

  5. Paste the following JSON into the Message (or Custom Payload) field. OEM will substitute the ${incident.*} variables:
    JSON 
    {
  "source": "oem",
  "sourcetype": "oem:alert",
  "index": "main",
  "event": {
    "incident_id": "${incident.incidentID}",
    "incident_num": "${incident.incidentNum}",
    "src": "${incident.target}",
    "target_type": "${incident.targetType}",
    "vendor_severity": "${incident.severity}",
    "title": "${incident.summary}",
    "description": "${incident.summary}",
    "resolution_status": "${incident.resolutionStatus}",
    "owner": "${incident.owner}",
    "creation_time": "${incident.creationTimestamp}",
    "data_source": "oem"
  }
}

  6. Select OK.

Create an incident rule set

  1. Navigate to Setup → Incidents → Incident Rules.

  2. Select Create Rule Set.

  3. Set the name to Send to Splunk.

  4. From Targets , select All targets. Select Add Rule.

  5. Select All new incidents and updated incidents as the rule type.

  6. From Add Actions, add a conditional action.

    1. In the Advanced Notifications section, select the Send to Splunk HEC webhook method created in step 2.

  7. Select Next, then Save. Confirm the rule set is enabled in the Incident Rules list.

Test OEM alert

Select Setup, then Notifications, then Notification Methods, and select Send to Splunk HEC and select Test. OEM will POST a sample payload to your HEC endpoint.

Confirm the test event arrived in Splunk:

index=main sourcetype="oem:alert"

Alternatively, trigger a real incident (for example, stop a monitored database listener) and verify the event appears in Splunk within a few seconds of the OEM incident being created.

The following is an example of an OEM event in Splunk:
JSON 
{
  "source": "oem",
  "sourcetype": "oem:alert",
  "index": "main",
  "event": {
    "incident_id": "10001",
    "incident_num": "INC-10001",
    "src": "mydb.example.com",
    "target_type": "oracle_database",
    "vendor_severity": "Critical",
    "title": "Tablespace SYSTEM is 95% full",
    "description": "Tablespace SYSTEM is 95% full",
    "resolution_status": "New",
    "owner": "SYSMAN",
    "creation_time": "2026-05-14T10:32:00Z",
    "data_source": "oem"
  }
}