Integrating with Splunk Enterprise via API

Splunk is a big data platform that simplifies the task of collecting and managing massive volumes of machine-generated data and searching for information within it. The technology is used for business and web analytics, application management, compliance, and security.

As a tenant administrator, it's important that you can monitor the connected systems and quickly identify and resolve any issues. TheBMC Helix Intelligent Integrations Splunk connector uses Rest API to collect events and metrics data from Splunk.

Related topics

Editing-and-deleting-integrations

Monitoring BMC Helix Intelligent Integrations

You can view the collected data in various BMC Helix applications and derive the following benefits:

BMC Helix application

Type of data collected or viewed

Benefits

BMC Helix Operations Management

Events

Use a centralized event view to monitor, filter, and manage events, and perform event operations in one place. 

Process events to help identify actionable events quickly from a large volume of event data.

For more information, see  Monitoring events and reducing event noise.

BMC Helix Operations Management

Metrics

Use alarm and variate policies to detect anomalies and eliminate false positives for more accurate results while monitoring the health of your system.

For more information, see Detecting anomalies by using static and dynamic thresholds.

BMC Helix AIOps

Situations (created from events)

Improve the mean time to resolve (MTTR) based on the situation-driven workflow.

Lower the mean time to detect or discover (MTTD) and the time required for investigating tickets.

For more information, see Monitoring situations.

BMC Helix Dashboards

Events and metrics

Create dashboards to get a consolidated view of data collected from third-party products across your environment. 

Improve the efficiency of your system by monitoring the key performance metrics and r espond to issues quickly to minimize the down time.

For more information, see Creating custom dashboards.

As a tenant administrator, perform the following steps to configure a connection with Splunk, verify the connection, and view the collected data in various BMC Helix applications.

ConnectorSteps.png

Watch the following video (10:25) to learn how to collect events and metrics data from Splunk and view the collected data in BMC Helix Operations Management.

icon_play.pnghttps://youtu.be/ixjY99sayfY

Supported versions

BMC Helix Intelligent Integrationssupports the following versions of Splunk for data collection.

  • Splunk Cloud Platform
  • Splunk Enterprise 9.2.2
  • Splunk Enterprise 9.0.5

Task 1: To plan for the connection

Review the following prerequisites to help you plan and configure a connection with Splunk.

Splunk prerequisites

  • This connector collects data from Splunk reports. A Splunk report contains events and metrics information. Ensure that the Splunk user account that you plan to use when configuring the Splunk connector has access to the required Splunk report.

  • Ensure that the Splunk report from which you want to collect data is part of the Search & Reporting application (Search app). For details, see the Search app in the Splunk Enterprise documentation.For example, the following figure shows the Splunk_II_Events report, which is part of the Search app. This report contains events from a third-party product. 

    Netcool_Events_Splunk.png  

  • To display meaningful data in BMC Helix Operations Management from a Splunk report containing events from a third-party product, the report should meet the following criteria:
    • The report must have fields that contain the following type of information:
      • Event ID: An identifier that can be concatenated with other fields in the report to get a unique identifier. For example, you can concatenate this identifier with issue, and differentiate events that differ only by status.
      • Title: The event’s title snippet. for example, High CPU alert.

      • Severity: The event severity.

        Important

        If severity is represented by numeric values in Splunk (for example, 1, 2), convert the values to a string format with the following possible values for ingestion into BMC Helix Operations Management:

        • Ok
        • Critical
        • Minor 
        • Major
        • Minor
        • Warning
        • Unknown

        For information about conversion, see Comparison and Conditional functions in the Splunk Enterprise documentation.

      • Status: The event status.

        Important

        If status is represented by numeric values in Splunk (for example, 1, 2), convert values to a string format with the following possible values for ingestion into BMC Helix Operations Management :

        • Created
        • Closed

        For information about conversion, see Comparison and Conditional functions in the Splunk Enterprise documentation.

      • Host: The host where the issue was observed. If the report does not contain this field, the Host field in BMC Helix Operations Management is derived from the Splunk host name for which the event report is being processed.
    • In addition, the report can have other, optional fields containing the following type of information such as:
      • Category: Indicates the event category.
      • Subcategory: Indicates the event subcategory.
      • Origin URI: Indicates the origin of the event.
        For example, the following sample report (Splunk_II_Events) contains the following fields: EventId, Severity, Summary, and Type.
        Splunk_Sample_Report_UnderSelectedFields.png
  • The Splunk fields from which you want to collect data and map to BMC Helix Intelligent Integrations while configuring the connector must appear under Selected Fields. For example, if you want to map EventId, Severity, or Type fields, these fields must appear under Selected Fields.
    Splunk_Sample_Report_SelectedFields.png

 
For more information, see Selected Fields in the Splunk Enterprise documentation.

  • To display meaningful data in BMC Helix Operations Management from a Splunk report containing metrics from a third-party product, the report should meet the following criteria:
    • The report must contain the following type of information:
      • timestamp

      • metrics
        For example, the following sample report (Messages by minute last 3 hours) contains the following columns: _time, /opt/splunk/var/log/introspection/resource usage.log, and so on.

        Important

        This report is only a sample. You can have as many metric columns as required in your report. You can name these columns according to your requirements.

         Splunk_Sample_Metrics_Report.png

    • The report fields containing metrics must have a numeric datatype.
    • Host: The host for which metrics were collected. If the report does not contain this field, the device name in BMC Helix Operations Management is derived from the Splunk host name for which the metric report is being processed.

BMC Helix Intelligent Integrations prerequisites

  • Depending on the location of the third-party product (SaaS, on-premises), choose one or more BMC Helix Intelligent Integrations deployment modes and review the corresponding port requirements. For information about various deployment modes and port requirements, see Deployment-scenarios.
  • Based on the deployment mode, use the BMC Helix Intelligent Integrations SaaS deployment or the BMC Helix Intelligent Integrations on-premises gateway or both. For more information about the gateway, see Deploying-the-BMC-Helix-Intelligent-Integrations-on-premises-gateway.
  • The on-premises gateway must be able to reach the third-party product on the required port (default is 8089).

In the preceding list, third-party product refers to Splunk. 

Task 2: To configure the connection with Splunk

  1. Depending on the deployment mode, perform one of the following steps to access BMC Helix Intelligent Integrations:

    • ​BMC Helix Intelligent Integrations SaaS – Log on to BMC Helix Portal, and click Launch on BMC Helix Intelligent Integrations.

    • BMC Helix Intelligent Integrations on-premises gateway – Use the following URL to access BMC Helix Intelligent Integrations: https://<hostName>:<portNumber>/swpui

  2. On the CONNECTORS  tab, click add_icon.png in the SOURCES panel.

  3. Click the 

    Splunk

     Enterprise tile.

  4. Specify the following details for the source connection:

    1. Specify a unique instance name.

      Best practice
      We recommend that you specify the instance name in the following format: 

      <sourceType>_<sourceControllerServerName>_<InstanceQualifier>

      The instance qualifier helps you to distinguish the multiple instances configured from the same source server. For example, you can name your instances as Splunk_Host_PROD, Splunk_Host_TEST, and so on.

    2. Specify the Splunk host name.
    3. Specify the Splunk HTTP or HTTPS port number depending on the connection protocol (default port number is 8089).
    4. Select the HTTPS option to use an https connection to the Splunk host.
    5. Enter the user name and password for the Splunk host.
  5. Click VALIDATE AND CREATE.
    The specified connection details are validated and the corresponding source connection is created in the Source Connection list.

  6. Select the source connection that you created from the list if it is not selected already.

    Important

    The destination host connection is created and configured automatically when the source connection is created.

  7. Ensure that the options for the datatypes for which you want to collect data are selected.

  8. Configure the collectors for the selected data types by clicking the respective data type in the Collectors section. Specify the parameters for the selected data type, as explained in the following table:

    Note: The ✅️  symbol indicates that this field is applicable to the data type.

    Parameter name

     Description

    Data Type

    Splunk Events

    Splunk Metrics

    Collection Schedule

    Select one of the following options to specify the data collection frequency:

    • Duration: When you select this option, data collection happens constantly. Specify the schedule in minutes, hours, or day. 
      Default: 5 minutes
      Example:
      Collection Schedule       is set to 5 mins.
      Current time is 00:30.

       If you run the collector just after 00:30, data is collected every 5 mins, first at 00:30 and next at 00:35, and so on.  

    • Cron schedule: When you select this option, data collection happens periodically. Specify the schedule by using a cron expression.
      A cron expression is a string consisting of five subexpressions (fields) that describe individual details of the schedule.        These fields, separated by blank spaces, can contain any of the allowed values with various combinations of the allowed characters for that field.
      Default: */5 * * * * (evaluates to 5 minutes)

      Format:
      Minutes Hours (24-hour format) Day of Month Month Day of Week

      Example:
      If you specify 10 15 3 7 * , data is collected at 15:10 hours every third day in the month of July.

    For more information about how this parameter affects data collection, see Data collection schedule.

    ✅️

    ❌️ 

    Data Collection Window

    Specify the historical time period (in minutes) from the current time for which the data should be collected from Splunk. 

    Default: 5 minutes

    Example:

    Collection Schedule is set to 5 mins.
     Data Collection Window is set to 5 mins.
    Current time is 00:30.

    If you run the collector just after 00:30, data is collected first at 00:30 for the interval, 00:25 - 00:30, and next at 00:35 for the interval, 00:30 - 00:35, and so on.

    For more information about this parameter, see Data collection window .

    ✅️

     

    ✅️

     

    Data Latency

    Specify the time (in minutes) by which the data time window should be shifted back on the timeline.

    This parameter is useful in delayed data availability situations.

    Default: 0 minutes

    Example:

    Collection Schedule is set to 5 mins.
     Data Collection Window is set to 10 mins.
    Data Latency is set to 2 mins.
    Current time is 00:30.

    If you run the collector just after 00:30, d ata is collected first at 00:30 for the interval, 00:18 to 00:28 and next at 00:35 for the interval, 0:23 to 00:33, and so on.

    For more information about this parameter, see Data latency.

    ✅️

     

    ✅️

     

    Saved Search Name

    Select the name with which you have saved the report in Splunk.

    This list of reports is updated automatically from Splunk.

    ✅️

    ✅️

    Splunk Fields to exclude 

    View the list of fields for which data will not be collected.

    ✅️

    ❌️

    Severity Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Severity field in BMC Helix Intelligent Integrations.

    Important:

    • The Severity Field Name list shows only those fields that are present in the Selected Fields list of the report.
    • The report field that you want to map to the Severity field might not be named Severity in your report. If the name differs, select a field that contains the severity values.
    • Ensure that the report field that you want to map to the Severity field has one of the following severity values:
      • Ok
      • Critical
      • Minor 
      • Major
      • Warning
      • Unknown

    ✅️

    ❌️

    Status Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Status field in BMC Helix Intelligent Integrations.

    Important:

    • The Status Field Name list shows only those fields that are present in the Selected Fields list of the report.
    • The report field that you want to map to the Status field might not be named Status in your report. If the name differs, select a field that contains the status values. For example, in the sample report, this field is named as Type . So, you need to select Type from this list.  
    • Ensure that the report field that you want to map to the Status field has one of the following status values:
      • Created
      • Closed

    ✅️

    ❌️

    Event ID Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Event ID field in BMC Helix Intelligent Integrations.

    Important:

    • The Event ID Field Name list shows only those fields that are present in the Selected Fields list of the report.
    • The report field that you want to map to the Event ID field might not be named Event ID in your report. If the name differs, select a field that contains the event ID values.
    • The report field that you want to map to the Event ID field must not be empty. If the report field is empty, no event is created in BMC Helix Operations Management.

    ✅️

    ❌️

    Title Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Title field in BMC Helix Intelligent Integrations.

    Important:

    • The Title Field Name list shows only those fields that are present in the Selected Fields  list of the report.
    • The report field that you want to map to the Title field might not be named Title in your report. If the name differs, select a field that contains the title value. For example, in the sample report, this field is named as Summary. So, you need to select Summary from this list.  

    ✅️

    ❌️

    Description Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Description field in BMC Helix Intelligent Integrations.

    Important:

    • The Description Field Name list shows only those fields that are present in the Selected Fields list of the report.
    • The report field that you want to map to the Description field might not be named Description in your Splunk  report. If the name differs, select a field that contains the description value.

    ✅️

    ❌️

    Category Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Category field in BMC Helix Intelligent Integrations.

    Important:

    • The Category Field Name list shows only those fields that are present in the Selected Fields list of the report.
    • The report field that you want to map to the Category field might not be named Category in the Splunk   report. If the name differs, select a field that has the category value.

    ✅️

    ❌️

    Subcategory Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Subcategory field in BMC Helix Intelligent Integrations.

    Important:

    • The Subcategory Field Name list shows only those fields that are present in the Selected Fields  list of the report.
    • The report field that you want to map to the Subcategory field might not be named Subcategory in your report. If the name differs, select a field that has the subcategory value.

    ✅️

    ❌️

    Origin URI Field Name

    Select a field available in the Splunk report from which you want to collect data and map to the Origin URI field in BMC Helix Intelligent Integrations.

    Important:

    • The Origin URI Field Name list shows only those fields that are present in the Selected Fields   list of the report.
    • The report field that you want to map to the Origin URI field might not be named Origin URI in your report. If the name differs, select a field that has the origin URI value.

    ✅️

    ❌️

    Configuration ID

    Select a field available in the Splunk report from which you want to collect data and map to the Configuration ID field in BMC Helix Intelligent Integrations.

    Important:

    • The Configuration ID  list shows only those fields that are present in the Selected Fields list of the report.
    • The report field that you want to map to the Configuration ID field might not be named Configuration ID in your report. If the name differs, select a field that has the configuration ID value.

    ✅️

    ❌️

    Configuration Item Type

    Select a field available in the Splunk report from which you want to collect data and map to the Configuration Item Type field in BMC Helix Intelligent Integrations.

    Important:

    • The Configuration Item Type  list shows only those fields that are present in the Selected Fields list of the report.
    • The report field that you want to map to the Configuration Item Type field might not be named Configuration Item Type in your report. If the name differs, select a field that has the configuration item type value.

    ✅️

    ❌️

    Maximum results per page 
    (Advanced parameter)

    Specify the maximum number of results that should be displayed per page. 

    Default: 10000

    ✅️

     

    ❌️

    Results Timeout (Advanced parameter)

    Specify the time, in minutes, after which no result should be displayed. 

    Default: 1 minute

    ✅️

    ❌️

    Field Name

    Select a field available in the Splunk report containing metrics that you want to collect. 

    For example, you can select /opt/splunk/var/log/introspection/resource_usage.log if you want to collect metrics data from this column in the sample report.

    Click the Add Field icon add_icon.pngto add more fields for metrics collection.

    Important:

    The report fields containing metrics must have a numeric datatype.

    ❌️

    ✅️

    Metric Name

    This field is reserved for future use. Do not enter any value in this field. 

    ❌️

    ❌️

  9. Click CREATE COLLECTORS to create the required collector streams for the selected data types.
  10. Configure the distributors for the selected data types by clicking the respective data type in the Distributors section.
    Specify the parameters for the selected data type, as explained in the following table:

    Parameter name

    Description

    Max Batching Size

    Specify the maximum number of data items to send in a single POST request to the destination API.
    The batch size     depends on the destination’s ability to buffer the incoming data.

    Default: 250

    Max Batching Delay

    Specify the maximum time (in seconds) to wait before building and processing a batch.

    Default: 3 seconds 

    Base Retry Delay

    Specify the initial time (in seconds) for which to wait before retrying to build and process a batch.
    The waiting time increases in the following sequence: n1, n2, n3, and so on, where n indicates the number of seconds.

    Default: 2 seconds

    Example: Base Retry Delay is set to 2 seconds. Retry is performed after 2, 4, 8, 16, ... seconds.

    Max Intra-Retry Delay

    Specify the maximum limit for the base retry delay. 

    Default: 60 seconds

    Example: Max Intra-Retry Delay is set to 60 seconds.
    Base Retry Delay is set to 2 seconds. Retries are performed 2, 4, 8, 16, 32,... seconds later.

    Max Retry Duration

    Specify the total time for retrying a delivery. For REST destinations, a delivery is a batch of data items in one POST request. 
    Default: 5 minutes
    Example: Max Retry Duration is set to 8 hours.
    Base Retry Delay is set to 2 seconds. Requests are sent for 2+4+8+16+32+64+132... until 8 hours in total duration is reached. After that, no subsequent attempts are made to retry the delivery. The assumption here is that if there is an outage or other issue with the destination tool, recovery should take less than the value of the Max Retry Duration parameter to be completed.

    Attributes To Be Dropped When Updating Events

    Specify the event attributes that you do not want to be updated in BMC Helix Operations Management when events are updated.

    For example, if you do not want an event's severity, source address, source category, and subcategory to be updated in BMC Helix Operations Management, you need to specify those attributes in a comma-separated format: severity,source_address,source_category,source_subcategory.

    Important: You can obtain the event attribute names in BMC Helix Operations Management, by exporting any event data in JSON, BAROC, XML, or CSV format. The exported file contains all attributes of the event data, and from there you can identify the attributes to be dropped. 

  11. Click CREATE DISTRIBUTORS to create the required distributor streams for the selected data types.

  12. Click one of the following buttons:

    • SAVE STREAM: Click this button if you want to edit the integration details before creating the instance. After you save the stream, the connector that you just created is listed in the SOURCES panel. Move the slider to the right to start the data stream.
    • SAVE AND START STREAM: Click this button if you want to save the integration details and start receiving data immediately.​​​​

Important
For a data stream, the Run Latency (max/avg), Items (Avg per Run), and Last Run Status columns on the Streams page might show the status as No Runs during the data collection process. After completion of the process, these columns are updated with an appropriate status.

Task 3: To verify the connection

From BMC Helix Intelligent Integrations , on the SOURCES panel, confirm that the data streams for the connection you created are running. Data streaming is indicated by moving colored arrows.

splunk_events_stream_22_2_final.png

  • A moving blue arrow (EventsStream_Icon.png ) indicates that the event stream is running. Event data will be pushed according to the configured Collection Schedule interval.
  • A moving red arrow (MetricsStream_Icon.png ) indicates that the metric stream is running. Metric data will be pushed according to the configured Collection Schedule interval.

To view data in BMC Helix applications

View data collected from Splunk in multiple BMC Helix applications.

To view events in BMC Helix Operations Management

  1. In BMC Helix Operations Management, select Monitoring > Events.
  2. Filter the events by the SplunkEvent class.
    SplunkEvents.png

Incoming events from Splunk are processed in BMC Helix Operations Management through a set of deduplication rules to determine whether the incoming event is a duplicate event or a new event. For more information, see Event-deduplication-suppression-and-closure-for-reducing-event-noise.

For more information about events, see Monitoring and managing events.

To view metrics in BMC Helix Operations Management

  1. In BMC Helix Operations Management, select Monitoring > Devices.
  2. Click the links for the required device.
  3. On the Monitors tab, click the required monitor.
    The Performance Overview tab shows the metrics graph. 

    SplunkMetrics.png
     

For information about metrics, see Viewing collected data.

To view Situations in BMC Helix AIOps

Before you view situations in BMC Helix AIOps, ensure that the following prerequisites are met: 

  1. CIs are present in BMC Helix Discovery or BMC Helix AIOps for the events that are being collected from the Splunk report.
  2. Create a Business Service model in one of the following applications:
  3. Perform one of the following tasks:

To view Situations:

  1. In BMC Helix AIOps , go to the Situations page.
    This page shows the Situations created from the events that are ingested into BMC Helix Operations Management. 
  2. Click the required Situation to view the messages contained in the Situation and other details such as priority and severity of the message. 
    The following figure shows a sample Situation created from three events:
    Splunk_Situation.png

For information about Situations, see Monitoring situations.

Mapping between Splunk and BMC Helix Operations Management

The following table shows the mapping between Splunk and BMC Helix Operations Management:

Event attribute

Splunk

BMC Helix Operations Management

Status

Created

Open

Closed

Closed

In Progress

Open

Confirmed

Open

Any other status

Open

Severity

Ok

Ok

Critical

Critical

Minor 

Minor

Major

Major

Warning

Warning

Unknown

Unknown

Title

Title

Message

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*