Splunk

Create Pagerly incidents automatically from Splunk alerts.

Create the integration in Pagerly

1. Navigate to https://workspace.pagerly.io/inbound and click "Add Inbound Integration".

2. Set a display name, select the team this integration belongs to, choose the integration below, and click "Add Integration".

3. Copy the generated webhook URL - you will paste it into the tool in the next section.

Configure Splunk

1. Open the saved search you want to alert on and click Save As → Alert, or edit an existing alert.

2. At the bottom of the alert configuration, click Add actions + and choose Webhook.

3. Paste the Pagerly webhook URL into the URL field.

4. Save the alert.

Splunk's webhook action sends a fixed payload, so there is nothing to paste:

{
  "sid": "...",
  "search_name": "Checkout errors above threshold",
  "results_link": "https://splunk.example.com/...",
  "result": { "count": "128" },
  "owner": "admin",
  "app": "search"
}

Notes

• Deduplication uses search_name, not sid. sid is unique to each firing, so keying on it would open a new incident every time the search ran. Using the search name groups repeated firings into one open incident.

• Severity and status are not present in Splunk's native payload, so both fall back to defaults. If your search emits them, point Payload Mapping at the relevant field.