We needed to integrate the Splunk Alerts into Zenoss, because even though Splunk can indeed send out alerts. Splunk does not have any clue about what an “Escalation Process” is. With Zenoss you can create an “Escalation Process”.
I have 2 ways to send events to Zenoss from Splunk..
- Write a Script that uses the snmptrap command.
- Write a Script that uses the Zenoss zensendevent command.
I decided to go with the Zenoss zensendevent command ( Which is a python script with no external dependencies, which can be copied from the Zenoss Server at $ZENHOME/bin/zensendevent ).
Now it’s time to get the ball rolling..
- On the Splunk Server I copied the zensendevent script from the Zenoss Server to Splunk on /opt/splunk/bin/scripts/zensendevent.
- I then created a shell script called Splunk2Zenoss.sh. ( This script takes the Saved Splunk Search and passes it over to Zenoss )This script will also be located in /opt/splunk/bin/scripts/Splunk2Zenoss.sh
- You will then need to modify the options in the script. (For instance the severity of the alert, the zenoss server, the event mapping, event key, login and passwd )
- I then created the saved search in Splunk and make sure to check the Trigger Shell Script option. ( Make sure to put the script name in here )
Continue reading “HowTo Send Splunk Alerts To Zenoss, And make them Look Like Splunk” »