vROPs and Splunk Integration using REST ?

[Uday_Mantri]

Hi Team,

How can we send vROPs alerts to splunk using REST Outbound setting. Can someone help with the detailed process on how to achieve this.

Regards,

Uday Mantri

[daphnissov]

VMware vROPs Integration | Splunkbase

[Uday_Mantri]

Hi Daphnissov,

I believe, the suggested integration requires steamweaver as a middleware between vROPs and Splunk.

But is there any way that we can use vROPs REST Notification Plugins to send json content to splunk HEC.

[daphnissov]

Sure, but it's all manual work. Start with the API docs and go from there.

[Uday_Mantri]

Well, have went through Splunk API documentation. We were unable to hit the POST REST to splunk from vROPs REST Notification settings. We configured the outbound setting through the user with admin rights on splunk but still it is not working.

Please suggest or refer us to all the required documents.

[KabirAli82]

That will never work until you build something to translate the vROPs JSON body to a Splunk JSON body. The fun part is that my customer is also wanting the same (not for Splunk though).

I'm note sure what you are trying to achieve, but we are using vRLI to send data to Splunk...

[Uday_Mantri]

Hi Kabir,

Thank You for helping us out.

Yes, we are aware about the translation part. We have actually done that. What we want is to send vROPs alerts directly to splunk using the REST outbound settings. We are trying to achieve it using HEC collector. The only thing we are unable to achieve is how to do the outbound settings.

It would also help if you could help with the configuration steps required in vROPs and splunk respectively.

[sxnxr]

What version of vrops are you using?

[Uday_Mantri]

vROPs 8.1