Requirements

This integration is compatible with the following versions of Splunk On-Call:

• Starter

• Growth

• Enterprise

Splunk On-Call configuration

In Splunk On-Call, select Integrations, Desk.com.

If the integration isn’t active, select Enable Integration to generate your endpoint URL. Make sure to replace the $routing_key section with the routing key you want to use. See Create Routing Keys in Splunk On-Call.

Desk.com configuration

Select the menu icon and then Admin.

On the admin page select Apps, then find Custom Action and select Install.

Next select Install Custom Action.

Accept the terms, then give the action a name. Set the authentication method to None, paste in your Post URL that you copied from Splunk On-Call in the first step, then make sure the action is set to Active. Select Create to finish.

On the next screen, select Add Action.

Give the action a name. Select POST a JSON string to a URL as the action type. Paste the following JSON snippet:

{ "entity_id":"{{case.id}}", "message_type":"CRITICAL", "state_message":"New Case: {{case.id}} about {{case.subject}}", "Case Description":"{{case.description}}", "Case Priority":"{{case.priority}}", "Customer":"{{case.customer}}", "Case Email":"{{case.emails}}", "alert_url":"{{case.direct_url}}" }

Then select Add Action.

Next, add the action to a Case Created rule. To do this, select Cases, then under Rules select Case Created and finally Add Rule.

Give the rule a name then select Add.

Add any Condition you might need. Set the Rule Actions field to Trigger an App Action, then select the Splunk On-Call action you previously created. Select Update.

If you want to create an action and rule for when the case is closed or resolved, follow the previous steps and use the following JSON snippet:

{ "entity_id":"{{case.id}}", "message_type":"RECOVERY", "state_message":"New Case: {{case.id}} about {{case.subject}}", "Case Description":"{{case.description}}", "Case Priority":"{{case.priority}}", "Customer":"{{case.customer}}", "Case Email":"{{case.emails}}", "alert_url":"{{case.direct_url}}" }