> For the complete documentation index, see [llms.txt](https://docs.pagerly.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pagerly.io/incidents-and-alerting/integrations/splunk.md).

# Splunk

### Create the integration in Pagerly

1\. Navigate to <https://workspace.pagerly.io/inbound> and click **"Add Inbound Integration"**.

2\. Set a display name, select the team this integration belongs to, choose the integration below, and click **"Add Integration"**.

3\. Copy the generated webhook URL - you will paste it into the tool in the next section.

### Configure Splunk

1\. Open the saved search you want to alert on and click **Save As → Alert**, or edit an existing alert.

2\. At the bottom of the alert configuration, click **Add actions +** and choose **Webhook**.

3\. Paste the Pagerly webhook URL into the **URL** field.

4\. Save the alert.

Splunk's webhook action sends a fixed payload, so there is nothing to paste:

```json
{
  "sid": "...",
  "search_name": "Checkout errors above threshold",
  "results_link": "https://splunk.example.com/...",
  "result": { "count": "128" },
  "owner": "admin",
  "app": "search"
}
```

### Notes

* **Deduplication** uses `search_name`, not `sid`. `sid` is unique to each firing, so keying on it would open a new incident every time the search ran. Using the search name groups repeated firings into one open incident.
* **Severity and status** are not present in Splunk's native payload, so both fall back to defaults. If your search emits them, point **Payload Mapping** at the relevant field.