Email-Based Incident Triggering in Splunk On-Call Using Outlook Rules

Applicability

Description

Incidents can be triggered in Splunk On-Call by configuring rules in Outlook emails. This can be done by using the Splunk On-Call email endpoint and adding specific conditions in the Outlook rules. Once the conditions are met, an incident will be triggered in Splunk On-Call.

Resolution

Here is workflow that needs to be configured.

1. Obtain the Splunk On-Call Email Endpoint:   Log in to Splunk On-Call. > Integrations > Email > Copy the email endpoint address generated for your organization along with routing key.

2. In the Outlook email > Click on the Settings Gear icon > Under the "Rules" section, click on "Add new rule." 

3. Define Trigger Conditions : Configure conditions that should trigger an incident, such as: Specific sender email address > Keywords in the subject  > Ensure the conditions are precise to avoid false incidents.

4. Configure the Action : Set the action to Forward the email. > Enter the Splunk On-Call email endpoint as the recipient in the Redirect field. > Review the rule settings. > Enable the rule and save changes.

5. Once the rules are saved, please try sending an email based on the conditions set, and the incidents will be created in Splunk On-Call.

For example, if the rule contains the following conditions:

Step 1: Name the rule "Testing."

Step 2: Add a Condition:

- Use "From" abc@gmail.com as the email address.

- Use "Subject Includes" "Incident."

Step 3: Add an Action: - Use "Redirect to" and enter the "Splunk On-call Email Endpoint." Then save the rule. If these above conditions are met, it will create an incident in Splunk On-call. 

Example Rule:

Email received from "From" address:

Incident created in Splunk On-call.