Splunk SMS alerts- integration manual
Here we describe how to setup Splunk with SMSEagle for SMS alerts with Splunk Modular Alert.
SMSEagle is an offline hardware SMS gateway. Therefore no external connection to 3rd party system is required. All notifications are generated on-premise and sent directly to a cellular network. This solution can be used in secure installations without Internet access.
Splunk uses HTTP API requests (see details: API).
- Create a new user in SMSEagle (menu Users > + Add Users, user access level: “User”).
- Grant API access to the created user:
- click Access to API beside the newly created user
- Enable APIv1
- Generate new token (copy it for later use)
- Add access permissions in section APIv1 Permission for: send_sms, send_tocontact, send_togroup
- Save settings
• Visit plugin site at Splunkbase. Download tar archive. Go to Splunk -> Manage Apps -> Choose File to Upload and Done.
• Restart Splunk
Splunk_SA_CIM is required by this app.
All configuration related to SMS Gateway settings messages is done from the Apps -> SMSEagle -> Configuration.
Enter SMSEagle API token and SMSEagle URL into corresponding fields.
URL should be in form: IP.ADDRESS.OF.SMSEAGLE (for example: 192.168.0.150)
Perform a search in Splunk and then navigate to : Save As -> Alert -> Trigger Actions -> Add Actions -> SMSEagle SMS Alerts.
On this dialogue you can enter:
• “Message” – contains SMS text. You may use Splunk custom alert action tokens in this field. The action tokens will be replaced with values from alert. More information can be found in Splunk docs under topic “Advanced options for working with custom alert actions”.
• “Phone Number” or “Phonebook Group name”. “Phone Number” should be in format: country code + number, for example: +1XXXXXXXXXXXXX (Without any _ or any other symbol). “Phone Number” can also be a comma delimited list of numbers. “Phonebook Group name” is a name of a group created in SMSEagle Phonebook.
• “High Priority” – if set to yes, message will have a high priority in SMS sending queue
• “Unicode” – if the Message contains national characters, set “Unicode” to yes
• “Flash” – “No” for normal SMS, “Yes” for flash SMS
• “Date” – (optional) enter date in YYYYmmDDHHMM to schedule it to a particular GMT date time.
Browse to See triggered Alerts: Settings -> Alert Actions -> SMSEagle SMS Alerts -> View Log Events
Or you can search logs of alerts directly in Splunk : index=_internal sourcetype=”ta:smseagle:sms:alerting:log” action_name=sms_eagle