Splunk On-Call

Splunk On-Call (formerly VictorOps) Outgoing Webhooks POST incident lifecycle events to Exhale. Each tenant gets a unique HTTPS URL token. Exhale scrubs the payload, upserts a Pulse (source=splunk_oncall), and runs triage on triggered events.

Optional triage summaries post back as Splunk On-Call incident notes via the Public API (X-VO-Api-Id / X-VO-Api-Key).

See Incoming integrations for how Splunk On-Call fits alongside PagerDuty, OpsGenie, and Manual webhook.

OpenAPI: POST /webhooks/splunk-oncall (header token) and POST /webhooks/splunk-oncall/{token}.

---

Endpoint

After Connect in Connections → Integrations → On-call & paging → Splunk On-Call:

Preferred (keeps tokens out of proxy access logs):

POST https://exhale.kolstromsystems.com/webhooks/splunk-oncall

Send header X-Exhale-Webhook-Token: {token}.

Path form (also supported):

POST https://exhale.kolstromsystems.com/webhooks/splunk-oncall/{token}

Design partners may substitute https://exhale-staging.kolstromsystems.com as the host.

• token — opaque URL segment; this token authenticates the delivery.
• Response: 202 Accepted with pulse_id, status, created, and message.

Unknown tokens return 404. Disabled or expired-trial tenants return 403.

---

Customer setup

1. Sign in as admin → Connections → Integrations → Splunk On-Call.
2. Click Connect Splunk On-Call and copy the webhook URL.
3. In Splunk On-Call, create Outgoing Webhooks for incident triggered / acknowledged / resolved (or Any-Incident with an event field).
4. Paste the Exhale URL, method POST, content type application/json, and the payload template below.
5. Use Send test alert to verify.

Recommended payload template

{
  "event": "triggered",
  "incident_number": "${{STATE.INCIDENT_NUMBER}}",
  "entity_id": "${{ALERT.entity_id}}",
  "entity_display_name": "${{ALERT.entity_display_name}}",
  "state_message": "${{ALERT.state_message}}",
  "alert_url": "${{ALERT.alert_url}}",
  "monitoring_tool": "${{ALERT.monitoring_tool}}",
  "message_type": "${{ALERT.message_type}}"
}

incident_number is required. Lifecycle mapping: triggered → receive + triage; acknowledged → acknowledged; resolved → resolved.

Triage notes

Under Edit settings, store API ID and API Key from Splunk On-Call Integrations → API, and enable note write-back. Exhale posts a scrubbed triage summary to POST /api-public/v1/incidents/{incidentNumber}/notes.

---

Operator guide

Full detail (dedupe, env vars, security): Splunk On-Call webhooks in the repository wiki.