ITSI - Adding custom actions for Notable Event Aggregation Policy

Available Languages

Updated:September 29, 2026
Document ID:SPLK046332

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk ITSI

Description

The user would like to enable "Splunk webhooks for Remedy" (which is already installed on ITSI SH) as a custom action under "Action Rules. As explained in Custom actions, adding a stanza in notable_event_actions.conf should be able to create a custom action.

Investigation

1. For Remedy integration with ITSI, the suggested method is utilizing the Splunk Add-on for BMC Remedy, EA Remedy  

Confirmed with users, they used to have Splunk add-on for Remedy earlier but it was broken for a while. To get that add-on working in stack, they had to do a lot of
customizations - "Splunk webhooks for Remedy". 

2. To add action rules in ITSI, need to add stanza in in notable_event_actions.conf:

As custom actions are executed as alert actions.  So a stanza matching the alert_action name needs to be added to notable_event_actions.conf.  Also note the corresponding itsi_sample_event_action_ping.py in the bin folder and alert action UI in itsi_sample_event_action_ping.html in data/ui/alerts directory.


Resolution

 https://docs.splunk.com/Documentation/ITSI/4.9.1/EA/Remedy Resolution Steps
1. Open or create a local version of notable_event_actions.conf at SPLUNK_HOME/etc/apps/SA-ITOA/local.
2. Add a stanza for the action (same as the alert action stanza name) you want to perform. For example: [itsi_sample_event_action_ping]
3. Set disabled = 0 to enable the custom action.
For example: 
[itsi_sample_event_action_ping]
disabled = 0
4. perform debug/refresh or restart on ITSI SH to apply the new configs

EA Remedy
Custom actions
notable_event_actions.conf

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Articles