Splunk Integration with WatchMyDC®

Introduction

This document describes the process of Splunk integration method with WatchMyDC®. The Splunk Enterprise version 8.2.3.3 (build e40ea5a516d2) is used while creating this document.

Dependencies

1. The WatchMyDC® Notifier is required for this integration. The notified is a dedicated app for Splunk integration with WatchMyDC®. Customers can download the app from this URL and store it on the user PC.
2. WatchMyDC® Collector status should be ‘online’ and the user needs the below information from the WatchMyDC® Dashboard:
   • Organization ID
   • Collector IP Address
3. Port TCP/5050 needs to be open on the direction from the Splunk Enterprise towards the WatchMyDC® Collector.
4. Please follow this document to bring the WatchMyDC® Collector online.

Splunk Integration Procedure

Configuration on the WatchMyDC® Dashboard

1. Login to WatchMyDC® Dashboard and select a Site and Network/Data Center
2. Navigate to Configuration Center and then App Synchronization page

3. Click on the Splunk icon, and then click to generate the Webhook Secret, copy the key.

Configuration on the Splunk Enterprise User Interface

1. Login to the Splunk Enterprise and click App settings icon:

2. Click on the ‘Install app from file’:

3. Browse the WatchMyDC Notifier app:

4. WatchMyDC Notifier app will be seen in the Apps list:

5. Click on Set up:

6. Set below parameters on required fields:

• WatchMyDC Collector Webhook Receiver: ‘{your collector IP}:5050’

• Organization ID: your Organization ID, collected from Organization Settings or Configuration Center > Collector page

• Webhook Secret: Collected from the Step#3 on this document

7. Click on Permissions, set required permissions. On this document we have set Read/Write permission to Everyone

Further Actions

1. Below example demonstrates the procedure to create a Trigger Action in Splunk. One Apache Unix server with Splunk Universal Forwarder has been setup to send Apache error logs to Splunk Index server. 
   • Navigate to Splunk Search & Reporting app
   • Make a search query, below is an example to search for Apache service ‘shutting down’ state, save the query using Save As.

index="10-23_os_log" sourcetype=apache_log shutting

Engage WatchMyDC Notifier with the subject search result as seen below:

As soon as the alert hits the Splunk, it sends the Webhook message to WatchMyDC®. The below image is from the Splunk Enterprise: 

The below message appears in WatchMyDC®:

2. Customers are able to create an Alert Definition on WatchMyDC® from the Action Center by engaging Automation playbooks.

A detail demonstration video will be published very soon!