openapi: 3.0.3 info: title: Splunk Observability Cloud — Detectors version: 3.10.0 description: 'API for creating, retrieving, updating, and deleting detectors. Requirements You must have an organization access token with the API permission or a session token to use the API. You must have the Splunk Observability Cloud admin or power role to use the POST /detector endpoint, PUT /detector/{id}, PUT /detector/{id}/enable, PUT /detector/{id}/disable, and DELETE /detector/{id} operations. You must have the Splunk Observability Cloud admin, power, or read_only role to use the GET /detector, GET /detector/{id},GET /detector/{id}/events, GET /detector/{id}/incidents, and POST /detector/validate operations.' x-provenance: method: reconstructed authored_by: Splunk (content) / API Evangelist (assembly) reconstructed_by: API Evangelist reconstructed_on: '2026-08-19' first_party: false provider_published: false note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's. Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset path, including invented control paths — so this is NOT first-party publication and is not graded as such. x-evidence: - type: source url: https://dev.splunk.com/observability/reference/ - type: source url: https://dev.splunk.com/observability/docs/apibasics/api_list/ servers: - url: https://api.{REALM}.observability.splunkcloud.com/v2 description: Detectors API endpoint URL variables: REALM: default: us0 description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0). security: - SessionToken: [] components: securitySchemes: SessionToken: type: apiKey in: header name: X-SF-Token description: Splunk Observability Cloud session token or org access token. paths: /detector: get: summary: Retrieve Detectors Query description: 'Retrieves the properties of one or more detectors. If you don''t specify any query parameters, the API returns up to the first 50 detector objects that you have access to.' parameters: - name: limit in: query description: 'Number of results to return from the list of detectors that match your search criteria. Together, the offset and limit properties provide paged access to the query results. You can repeatedly download small slices of a large query result, which helps you avoid bandwidth and performance problems.' schema: type: integer format: int32 default: 50 example: 100 maximum: 10000 minimum: 0 - name: name in: query description: 'Search criteria that the API tries to match to the name property of existing detectors. The match can be full or partial. If the string is empty, it''s ignored and the API uses the other criteria in the query. For example, a value of "per" matches detectors for which the name contains "dropped per day", "95th percentile", or "personal disk usage".' schema: type: string - name: offset in: query description: 'Index, in the list of detectors that match your search criteria, at which you want to start downloading results. Together, the offset and limit properties provide paged access to the query results. You can repeatedly download small slices of a large query result, which helps you avoid bandwidth and performance problems.' schema: type: integer format: int32 default: 0 minimum: 0 - name: orderBy in: query description: The field on which the API should sort the query results. The API only supports fields specified in the enum. schema: type: string enum: - creator - created - description - lastUpdated - lastUpdatedBy - name - tags default: lastUpdated - name: tags in: query description: 'Search criteria that the API applies to the elements of the tags array property of detectors. The string must be an exact match. You can specify multiple tags parameters in the same request.' schema: type: string - name: prefixTags in: query description: 'Search filter that the API applies to find and return only detectors which have at least one tag starting with the provided prefix, for each prefix provided.' schema: type: array items: type: string - name: prefixTagExclusions in: query description: 'Search filter that the API applies to exclude detectors which have at least one tag starting with any of the provided prefixes from the query result.' schema: type: array items: type: string - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Valid Get Detectors Response type: object properties: count: title: Count of matched detectors type: integer format: int32 readOnly: true example: 25 description: 'Number of detectors that match the search criteria. This property is read-only; it''s always set by the system. Note: Count isn''t the same as the number of detectors returned in the response body: sizeOf(results): Size of the array returned in the response body. count: Number of objects that match the search criteria' results: type: array items: title: Detector Properties Object type: object properties: authorizedWriters: title: Organizations and teams with write permission for an object type: object properties: teams: type: array items: type: string example: DevOps description: 'List of team IDs that have write access to this object, in the form of a JSON array' users: type: array items: type: string example: AAXYAAAAAZ4 description: 'List of user IDs that have write access to this object, in the form of a JSON array' description: 'If your organization has the write permissions feature enabled, you can use this property to specify the user and team IDs that have write access to the object you''re specifying.' created: title: Creation time type: integer format: int64 example: 1556825430000 readOnly: true description: 'The time the detector was created, in *nix time in milliseconds. This property is read-only; it''s always set by the system.' creator: title: Creator user ID type: string example: AAXYAAAAAZ3 readOnly: true description: 'Splunk Observability Cloud ID of the user who created the detector. This property is read-only; it''s always set by the system.' customProperties: title: Custom properties type: object additionalProperties: null readOnly: false writeOnly: false example: property1: detectorArea value1: internal detectors description: Metadata for a detector, in the form of a JSON object. description: title: Detector description type: string readOnly: false writeOnly: false example: jvm CPU load warning description: 'Description of a detector. The value appears in the Detector window displayed in the UI Actions menu.' detectorOrigin: title: How the detector was created type: string enum: - Standard - AutoDetect - AutoDetectCustomization example: Standard default: Standard description: 'Indicates how a detector was created. The possible values are: Standard: Detector created using the API or the user interface. AutoDetect: Detector is an AutoDetect detector created by Splunk Observability Cloud. AutoDetectCustomization: Detector is a customization of another AutoDetect detector. Note: You can only use Standard or AutoDetectCustomization to create custom detectors. If you try to pass an invalid value for detectorOrigin when creating or updating detectors, you receive a "Not valid detector origin" error message in the response.' id: title: Detector system ID type: string readOnly: true description: 'ID of a detector. When you retrieve events or incidents for a detector, this ID is for the detector that generated the event or incident. This property is read-only; it''s always set by the system.' labelResolutions: title: Alert resolution times type: object readOnly: true additionalProperties: type: integer example: DetectorA: 3000 DetectorB: 5000 description: 'Key-value pairs that indicate how often data is analyzed to determine if an alert should be triggered, in the form of a JSON object containing properties. Each key is the label name of a call to publish() in the SignalFlow for the detector, and each value is the resolution time for that publish() block. For example, to retrieve the label resolution of the call to publish("DetectorStatement") from this object, use labelResolutions.DetectorStatement. Label resolution is different from the data display resolution used to populate the detector visualization. The data display resolution is automatically set to the coarsest resolution of all of the SignalFlow publish() calls associated with the detector, since they are all displayed together in the same visualization.' lastUpdated: title: Detector last updated time type: integer format: int64 example: 1557689430000 readOnly: true description: The last time the detector was updated, in *nix time in milliseconds. lastUpdatedBy: title: Detector last updated ID type: string readOnly: true example: ZZyZZZZXXXQ description: 'The ID of the user who last updated the detector. If the system made the last update, the value is "AAAAAAAAAA". This property is read-only; it''s always set by the system.' locked: title: Detector lock state type: boolean example: false description: 'Detector lock state. If true, nobody can modify the detector in any way; otherwise, anyone can modify it.' maxDelay: title: Late-arriving data point delay time type: integer format: int32 minimum: 0 maximum: 900000 default: 0 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait for late-arriving data before continuing the SignalFlow computation for the detector. If data is arriving on time, the computation continues before the duration expires. The default is 0, which tells SignalFlow to set the limit dynamically. To set a duration to wait even if data is arriving on time, use minDelay.' minDelay: title: data point pre-processing delay time type: integer format: int32 minimum: 0 maximum: 900000 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait before continuing the SignalFlow computation for the detector. The computation waits for this duration to expire, even if the data is arriving in a timely fashion. To set a duration to wait for late-arriving data, use maxDelay.' name: title: Detector name (displayed) type: string minLength: 1 readOnly: false writeOnly: false example: JVM CPU Load detector description: 'Displayed name of the detector in the UI. When you retrieve events or incidents, this property contains the name of the associated detector.' overMTSLimit: type: boolean readOnly: true example: false title: OverMTSLimit description: 'If true, one or more statements in a detector matched too many MTS, and the system forcibly limited the detector. This usually occurs when the detector is looking at incomplete data or an incomplete aggregation. When this flag is true, use partition_filter() functions to split your dataset into smaller pieces, then use the union() function to rejoin the results in a subsequent computation. The union() function still observes the MTS limit, so an aggregation of the partial streams must first limit the dataset prior to recombining the streams. This property is read-only; it''s always set by the system.' parentDetectorId: title: ID of the parent AutoDetect detector type: string description: ID of the parent detector from which this detector is customized and created. This property is required for detectors with detectorOrigin of type AutoDetectCustomization. packageSpecifications: title: SignalFlow internal field type: string default: '' description: For internal use only programText: title: SignalFlow program for the detector type: string readOnly: false writeOnly: false example: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); description: 'Specifies the SignalFlow program that defines the detector. This program must include one or more calls to the SignalFlow detect() function. The program must also call publish() on each detect stream, using a label that''s unique to the program. If you want to use custom notification messages that include input data, assign your detect conditions to variables. To use multiple lines in your program, terminate each line with a semicolon ; or newline character \n. To learn more about SignalFlow programs for detectors, see the Detectors topic in the Developers Guide. Note: For detectors with detectorOrigin of type AutoDetectCustomization, it is best practice to keep the same function in the programText property as the parent detector. You can still pass different arguments for the function.' rules: title: Alert Rule Definitions type: array items: title: Detector Rule Object type: object required: - detectLabel - severity properties: description: type: string default: '' readOnly: false writeOnly: false example: JVM CPU Load test title: RuleDescription description: 'Description for the rule. Displays as the alert condition in the Alert Rules tab of the detector editor in the UI' detectLabel: type: string example: cpuLoad title: RuleDetectLabel description: 'Label of the publish() call for the detect() function associated with this rule.' disabled: type: boolean default: false readOnly: false writeOnly: false example: false title: Disabled description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from a detector to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a detector notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string example: https://example.com/alarm/{{incidentId}}?status={{status}} readOnly: false writeOnly: false description: 'The URL of a webhook integration. You can use the Handlebars syntax for this URL. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow title: Notifications description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. To send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' reminderNotification: type: object properties: type: type: string enum: - TIMEOUT example: TIMEOUT description: Type of reminder notifications. The only supported value is TIMEOUT. interval: type: integer format: int64 example: 300000 description: The interval at which you want to receive reminder notifications, in milliseconds. Interval value must be between 5 minutes and 7 days, inclusive. Interval value must be shorter than or equal to the value of timeout. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. timeout: type: integer format: int64 example: 3600000 description: The duration during which you want to receive reminder notifications, in milliseconds. Timeout value must be between 5 minutes and 7 days, inclusive. Timeout value must be longer than or equal to the value of interval. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. title: ReminderNotification description: Set up reminder notifications for your detectors so you can receive multiple notifications for active alerts over a defined period of time. skipClearNotificationStates: type: array items: type: string enum: - OK - AUTO_RESOLVED - STOPPED - MANUALLY_RESOLVED title: AlertClearState description: 'Specifies the different states an alert can transition to when clearing, in the form of a JSON string. These states can be used in the skipClearNotificationStates property to control which types of clear notifications are sent. The possible values are: "OK": The alert is cleared. "AUTO_RESOLVED": The Auto-clear setting is applied to the detector and the specified duration has elapsed. To learn more, see Auto-clear alerts. "STOPPED": The detector is muted or inactive when the alert is triggered. "MANUALLY_RESOLVED": The alert is manually set as resolved during an alert state.' example: - MANUALLY_RESOLVED - AUTO_RESOLVED description: 'Specifies which types of alert clear states should not trigger notifications, in the form of a JSON array of AlertClearState enum values. When an alert clears with one of the specified states, notifications will be suppressed while the alert state and incident data are still updated normally. This allows you to reduce notification noise by selectively suppressing clear notifications based on how the alert was resolved. For example, you might want to suppress notifications when alerts are manually resolved or auto-resolved due to missing data, but still receive notifications when alerts clear naturally (OK state).' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\"\ \ in detector \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"\ }}.\n{{/if}}\n\n{{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\n\ Mean value of signal in the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n\ {{#if anomalous}}Trigger threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold:\ \ {{inputs.clear_top.value}}.\n{{/if}}\n\n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n\ {{/notEmpty}}\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n\ {{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" title: ParameterizedBody description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{rulename}}} in detector {{{detectorName}}} title: ParameterizedSubject description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com title: RunbookUrl description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false title: Severity description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check detector in Splunk Observability Cloud description: 'Plain text to show in the notification message for an alert. Use this text to suggest the first course of action to take when a signal triggers an alert. To show this text, customize the parameterizedBody property to add the {{{tip}}} variable.' description: Single alert rule readOnly: false writeOnly: false status: title: Status of this detector type: string readOnly: true enum: - ABORTED - ACTIVE - INITIALIZING - RETRYING_INITIALIZATION - FAILED example: ACTIVE description: 'Status of the analytics job for this detector. This property is read-only. The possible values are: "ABORTED": The analytics job for this detector has been aborted by the system. "ACTIVE": The analytics job for this detector is up and running. "INITIALIZING": The analytics job for this detector is starting up after creation or re-starting after an update. "RETRYING_INITIALIZATION": The analytics job for this detector failed to start and Splunk Observability Cloud will try to start the job again after some time. "FAILED": The analytics job for this detector failed to start and the system has reached maximum number of initialization attempts.' tags: title: Keyword filters type: array readOnly: false writeOnly: false items: type: string maxLength: 256 maxItems: 50 readOnly: false writeOnly: false description: 'UTF-8 string, starting with an uppercase or lowercase alphabetic character. The maximum length is expressed in characters; if a string consists solely of single-byte UTF-8 entities, 1024 characters are available.' example: - dev - oregon - offline description: 'Array of keywords that filters detectors by one of their properties. Use tags to indicate the state of a detector or its data source (for example, you can label a detector with a "prod" tag to indicate that it monitors a production environment). Note: You can have no more than 50 tags per detector.' teams: title: Team IDs for this detector type: array readOnly: false writeOnly: false items: type: string readOnly: false writeOnly: false example: - DevOps - Engineering - Support description: 'IDs of teams associated with this detector. The teams associated with a detector can see the detector and its active alerts on the team''s landing page in the UI. The list of teams associated with a detector is independent of notification settings. Teams specified in this field don''t automatically get notified of new alerts, and teams that choose to get alerts do not have to display the detector on their team landing page in the web application.' timezone: title: Time zone for SignalFlow calendar window transformations type: string default: UTC readOnly: false writeOnly: false example: America/Detroit description: 'Specifies which time zone SignalFlow should use as the basis of calendar window transformation methods. For example, if you set "timezone": "Europe/Paris" and then use the transformation sum(cycle="week", cycle_start="Monday") in your detector''s SignalFlow program, the calendar window starts on Monday, Paris time. For a list of supported time zones, see Time zone for calendar window transformations.' visualizationOptions: title: Detector appearance options type: object properties: disableSampling: type: boolean default: false readOnly: false writeOnly: false example: false description: 'If true, Splunk Observability Cloud displays all data points in the detect() streams; otherwise, Splunk Observability Cloud only samples data points. Using sampling improves performance.' publishLabelOptions: title: List of display options for the detector's chart type: array items: title: Display options for the detector's chart type: object properties: displayName: title: Detector chart display name type: string example: JVM CPU load description: 'Specifies the Data Table column header for a single publish() block in a detector''s chart. If you don''t specify a value, Splunk Observability Cloud uses the name of the dimension that''s providing the data for the publish() block.' label: title: Label of a publish() object in a SignalFlow program type: string example: cpuLoad description: 'Specifies a SignalFlow publish() object label. Splunk Observability Cloud uses this value to associate the publish() block output with a publishLabelOptions object.' paletteIndex: title: Color choice type: integer minimum: 0 maximum: 15 example: 9 description: '0-based index into the color table displayed in Charts color palettes. Only the first 16 entries (0-15) are allowed for this value. Splunk Observability Cloud uses the index to determine which color to use for displaying the output of a single publish() object in a detector''s table.' valuePrefix: title: String to prepend to data table values type: string example: 'Avg ' description: 'Specifies a string to prepend to the value in a data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point on a chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valuePrefix if you set options.publishLabelOptions.valueUnit for the same plot.' valueSuffix: title: String to append to detector chart's data table values type: string example: pct description: 'Specifies a string to append to the value in the data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point in the chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valueSuffix if you set options.publishLabelOptions.valueUnit for the same plot.' valueUnit: title: Display units used with the detector's chart type: string enum: - Bit - Kilobit - Megabit - Gigabit - Terabit - Petabit - Exabit - Zettabit - Yottabit - Byte - Kibibyte - Mebibyte - Gibibyte - Tebibyte - Pebibyte - Exbibyte - Zebibyte - Yobibyte - Nanosecond - Microsecond - Millisecond - Second - Minute - Hour - Day - Week example: Second description: 'Specifies the units of measure for values displayed in a detector''s chart. Splunk Observability Cloud assumes that the raw data uses the unit of measure you select. For example, the value 1000 in a chart where you''ve set options.publishLabelOption.valueUnit to bits appears as 1 Kilobit, and the value 1024 in a plot set to Bytes appears as 1 Kebibyte. Splunk Observability Cloud scales units within their own unit type. Refer to Display units and other labels for a full specification. The options.publishLabelOptions.valueUnit option applies to scaling and labeling in chart tooltips, axes, and data tables. If options.publishLabelOptions.valueUnit affects the chart presentation, it overrides options.publishLabelOptions.valuePrefix and options.publishLabelOptions.valueSuffix.' description: 'One set of options that control the appearance of a publish() block in a detector''s chart, in the form of a JSON object. Splunk Observability Cloud matches the objects label value to match it to its publish() block.' description: 'List of display options for a detector''s chart. Each element in the list contains the options for a single SignalFlow publish() block in the detector''s SignalFlow program. The list has the form of a JSON array of objects. Splunk Observability Cloud matches an object''s label value to match it to a publish() block.' showDataMarkers: type: boolean default: true readOnly: false writeOnly: false example: true description: If True, visualizations contain markers for each data point. showEventLines: type: boolean default: false readOnly: false writeOnly: false example: true description: 'If True, the visualization contains a vertical line at the time value that the detect() function triggers an alert.' time: title: Time Object type: object properties: end: type: integer format: int64 default: 0 example: 1557693030000 readOnly: false writeOnly: false description: 'The timestamp of the last time to display in the visualization, specified in *nix time in milliseconds.' range: type: integer format: int64 minimum: 0 default: 0 readOnly: false writeOnly: false example: 0 description: 'The number of milliseconds to display in the visualization. This is a is a rolling range with the current time at the right border of the chart display. Use 0 to use the default behavior; this corresponds to -15m for most metrics and -1h for AWS, GCP, and Azure metrics.' start: type: integer format: int64 minimum: 0 default: 0 example: 1557682230000 readOnly: false writeOnly: false description: 'The timestamp of the first time to display in the visualization, specified in *nix time in milliseconds.' type: type: string readOnly: false writeOnly: false enum: - absolute - relative description: 'Enumeration that controls the use of an explicit time range. A value of "absolute" indicates that you want an explicit time range; "relative" indicates that you want the time relative to the last N milliseconds. The default is "relative".' description: Options for the time displayed in the detector visualization. description: Options that control the appearance of a detector in the user interface. description: Properties of a detector, in the form of a JSON object description: 'Results of a search for detectors, in the form of a JSON array of objects. Each element is a detector object.' description: Properties in the response body of a successful retrieval of detectors examples: example: value: count: 25 results: - authorizedWriters: teams: - DevOps users: - AAXYAAAAAZ4 created: 1556825430000 creator: AAXYAAAAAZ3 customProperties: property1: detectorArea value1: internal detectors description: jvm CPU load warning detectorOrigin: Standard id: string labelResolutions: DetectorA: 3000 DetectorB: 5000 lastUpdated: 1557689430000 lastUpdatedBy: ZZyZZZZXXXQ locked: false maxDelay: 60000 minDelay: 60000 name: JVM CPU Load detector overMTSLimit: false packageSpecifications: string parentDetectorId: string programText: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); rules: - description: JVM CPU Load test detectLabel: cpuLoad disabled: false notifications: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow parameterizedBody: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\"\ \ in detector \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n\ {{/if}}\n\n{{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of\ \ signal in the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\ \n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n\ {{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" parameterizedSubject: Notification for {{{rulename}}} in detector {{{detectorName}}} reminderNotification: interval: 300000 timeout: 3600000 type: TIMEOUT runbookUrl: www.example.com severity: Info skipClearNotificationStates: - MANUALLY_RESOLVED - AUTO_RESOLVED tip: Check detector in Splunk Observability Cloud status: ACTIVE tags: - dev - oregon - offline teams: - DevOps - Engineering - Support timezone: America/Detroit visualizationOptions: disableSampling: false publishLabelOptions: - displayName: JVM CPU load label: cpuLoad paletteIndex: 9 valuePrefix: 'Avg ' valueSuffix: pct valueUnit: Second showDataMarkers: true showEventLines: true time: end: 1557693030000 range: 0 start: 1557682230000 type: absolute security: - SessionToken: [] tags: - Detectors post: summary: Create Single Detector description: 'Creates a new detector object. Detectors define rules for identifying conditions of interest to the customer, and the notifications to send when the conditions occur or stop occurring. For more information on detectors including the types of notifications available, see Detect Anomalies with Detectors in the Developers Guide.' parameters: - name: Content-Type in: header description: Request body format. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string requestBody: required: true content: application/json: schema: title: Properties for creating a detector type: object required: - name - programText - rules properties: authorizedWriters: title: Organizations and teams with write permission for an object type: object properties: teams: type: array items: type: string example: DevOps description: 'List of team IDs that have write access to this object, in the form of a JSON array' users: type: array items: type: string example: AAXYAAAAAZ4 description: 'List of user IDs that have write access to this object, in the form of a JSON array' description: 'If your organization has the write permissions feature enabled, you can use this property to specify the user and team IDs that have write access to the object you''re specifying.' customProperties: title: Custom properties type: object additionalProperties: true example: - systemId: dev machineName: dev1 - centerId: oregon centerName: oregonDev description: 'User metadata, in the form of properties in a JSON object. The name and value of each property are strings.' description: title: Detector description type: string default: '' example: 'JVM CPU Load detector. Monitors the CPU Load for the JVM, and reports overages. ' description: 'Detailed description of the detector. Splunk Observability Cloud displays the value in the Detector pane accessed from the Actions menu in the web UI.' detectorOrigin: title: How the detector was created type: string enum: - Standard - AutoDetect - AutoDetectCustomization example: Standard default: Standard description: 'Indicates how a detector was created. The possible values are: Standard: Detector created using the API or the user interface. AutoDetect: Detector is an AutoDetect detector created by Splunk Observability Cloud. AutoDetectCustomization: Detector is a customization of another AutoDetect detector. Note: You can only use Standard or AutoDetectCustomization to create custom detectors. If you try to pass an invalid value for detectorOrigin when creating or updating detectors, you receive a "Not valid detector origin" error message in the response.' maxDelay: title: Late-arriving data point delay time type: integer format: int32 minimum: 0 maximum: 900000 default: 0 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait for late-arriving data before continuing the SignalFlow computation for the detector. If data is arriving on time, the computation continues before the duration expires. The default is 0, which tells SignalFlow to set the limit dynamically. To set a duration to wait even if data is arriving on time, use minDelay.' minDelay: title: data point pre-processing delay time type: integer format: int32 minimum: 0 maximum: 900000 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait before continuing the SignalFlow computation for the detector. The computation waits for this duration to expire, even if the data is arriving in a timely fashion. To set a duration to wait for late-arriving data, use maxDelay.' name: title: Detector name (displayed) type: string minLength: 1 readOnly: false writeOnly: false example: JVM CPU Load detector description: 'Displayed name of the detector in the UI. When you retrieve events or incidents, this property contains the name of the associated detector.' packageSpecifications: title: SignalFlow internal field type: string default: '' description: For internal use only parentDetectorId: title: ID of the parent AutoDetect detector type: string description: ID of the parent detector from which this detector is customized and created. This property is required for detectors with detectorOrigin of type AutoDetectCustomization. programText: title: SignalFlow program for the detector type: string readOnly: false writeOnly: false example: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); description: 'Specifies the SignalFlow program that defines the detector. This program must include one or more calls to the SignalFlow detect() function. The program must also call publish() on each detect stream, using a label that''s unique to the program. If you want to use custom notification messages that include input data, assign your detect conditions to variables. To use multiple lines in your program, terminate each line with a semicolon ; or newline character \n. To learn more about SignalFlow programs for detectors, see the Detectors topic in the Developers Guide. Note: For detectors with detectorOrigin of type AutoDetectCustomization, it is best practice to keep the same function in the programText property as the parent detector. You can still pass different arguments for the function.' rules: title: Alert Rule Definitions type: array items: title: Detector Rule Object type: object required: - detectLabel - severity properties: description: type: string default: '' readOnly: false writeOnly: false example: JVM CPU Load test title: RuleDescription description: 'Description for the rule. Displays as the alert condition in the Alert Rules tab of the detector editor in the UI' detectLabel: type: string example: cpuLoad title: RuleDetectLabel description: 'Label of the publish() call for the detect() function associated with this rule.' disabled: type: boolean default: false readOnly: false writeOnly: false example: false title: Disabled description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from a detector to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a detector notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string example: https://example.com/alarm/{{incidentId}}?status={{status}} readOnly: false writeOnly: false description: 'The URL of a webhook integration. You can use the Handlebars syntax for this URL. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow title: Notifications description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. To send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' reminderNotification: type: object properties: type: type: string enum: - TIMEOUT example: TIMEOUT description: Type of reminder notifications. The only supported value is TIMEOUT. interval: type: integer format: int64 example: 300000 description: The interval at which you want to receive reminder notifications, in milliseconds. Interval value must be between 5 minutes and 7 days, inclusive. Interval value must be shorter than or equal to the value of timeout. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. timeout: type: integer format: int64 example: 3600000 description: The duration during which you want to receive reminder notifications, in milliseconds. Timeout value must be between 5 minutes and 7 days, inclusive. Timeout value must be longer than or equal to the value of interval. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. title: ReminderNotification description: Set up reminder notifications for your detectors so you can receive multiple notifications for active alerts over a defined period of time. skipClearNotificationStates: type: array items: type: string enum: - OK - AUTO_RESOLVED - STOPPED - MANUALLY_RESOLVED title: AlertClearState description: 'Specifies the different states an alert can transition to when clearing, in the form of a JSON string. These states can be used in the skipClearNotificationStates property to control which types of clear notifications are sent. The possible values are: "OK": The alert is cleared. "AUTO_RESOLVED": The Auto-clear setting is applied to the detector and the specified duration has elapsed. To learn more, see Auto-clear alerts. "STOPPED": The detector is muted or inactive when the alert is triggered. "MANUALLY_RESOLVED": The alert is manually set as resolved during an alert state.' example: - MANUALLY_RESOLVED - AUTO_RESOLVED description: 'Specifies which types of alert clear states should not trigger notifications, in the form of a JSON array of AlertClearState enum values. When an alert clears with one of the specified states, notifications will be suppressed while the alert state and incident data are still updated normally. This allows you to reduce notification noise by selectively suppressing clear notifications based on how the alert was resolved. For example, you might want to suppress notifications when alerts are manually resolved or auto-resolved due to missing data, but still receive notifications when alerts clear naturally (OK state).' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\" triggered\ \ at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\" in detector\ \ \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\n{{#if\ \ anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in the\ \ last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\ \n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n\ {{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" title: ParameterizedBody description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{rulename}}} in detector {{{detectorName}}} title: ParameterizedSubject description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com title: RunbookUrl description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false title: Severity description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check detector in Splunk Observability Cloud description: 'Plain text to show in the notification message for an alert. Use this text to suggest the first course of action to take when a signal triggers an alert. To show this text, customize the parameterizedBody property to add the {{{tip}}} variable.' description: Single alert rule readOnly: false writeOnly: false tags: title: Keyword filters type: array readOnly: false writeOnly: false items: type: string maxLength: 256 maxItems: 50 readOnly: false writeOnly: false description: 'UTF-8 string, starting with an uppercase or lowercase alphabetic character. The maximum length is expressed in characters; if a string consists solely of single-byte UTF-8 entities, 1024 characters are available.' example: - dev - oregon - offline description: 'Array of keywords that filters detectors by one of their properties. Use tags to indicate the state of a detector or its data source (for example, you can label a detector with a "prod" tag to indicate that it monitors a production environment). Note: You can have no more than 50 tags per detector.' teams: title: Team IDs for this detector type: array readOnly: false writeOnly: false items: type: string readOnly: false writeOnly: false example: - DevOps - Engineering - Support description: 'IDs of teams associated with this detector. The teams associated with a detector can see the detector and its active alerts on the team''s landing page in the UI. The list of teams associated with a detector is independent of notification settings. Teams specified in this field don''t automatically get notified of new alerts, and teams that choose to get alerts do not have to display the detector on their team landing page in the web application.' timezone: title: Time zone for SignalFlow calendar window transformations type: string default: UTC readOnly: false writeOnly: false example: America/Detroit description: 'Specifies which time zone SignalFlow should use as the basis of calendar window transformation methods. For example, if you set "timezone": "Europe/Paris" and then use the transformation sum(cycle="week", cycle_start="Monday") in your detector''s SignalFlow program, the calendar window starts on Monday, Paris time. For a list of supported time zones, see Time zone for calendar window transformations.' visualizationOptions: title: Detector appearance options type: object properties: disableSampling: type: boolean default: false readOnly: false writeOnly: false example: false description: 'If true, Splunk Observability Cloud displays all data points in the detect() streams; otherwise, Splunk Observability Cloud only samples data points. Using sampling improves performance.' publishLabelOptions: title: List of display options for the detector's chart type: array items: title: Display options for the detector's chart type: object properties: displayName: title: Detector chart display name type: string example: JVM CPU load description: 'Specifies the Data Table column header for a single publish() block in a detector''s chart. If you don''t specify a value, Splunk Observability Cloud uses the name of the dimension that''s providing the data for the publish() block.' label: title: Label of a publish() object in a SignalFlow program type: string example: cpuLoad description: 'Specifies a SignalFlow publish() object label. Splunk Observability Cloud uses this value to associate the publish() block output with a publishLabelOptions object.' paletteIndex: title: Color choice type: integer minimum: 0 maximum: 15 example: 9 description: '0-based index into the color table displayed in Charts color palettes. Only the first 16 entries (0-15) are allowed for this value. Splunk Observability Cloud uses the index to determine which color to use for displaying the output of a single publish() object in a detector''s table.' valuePrefix: title: String to prepend to data table values type: string example: 'Avg ' description: 'Specifies a string to prepend to the value in a data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point on a chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valuePrefix if you set options.publishLabelOptions.valueUnit for the same plot.' valueSuffix: title: String to append to detector chart's data table values type: string example: pct description: 'Specifies a string to append to the value in the data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point in the chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valueSuffix if you set options.publishLabelOptions.valueUnit for the same plot.' valueUnit: title: Display units used with the detector's chart type: string enum: - Bit - Kilobit - Megabit - Gigabit - Terabit - Petabit - Exabit - Zettabit - Yottabit - Byte - Kibibyte - Mebibyte - Gibibyte - Tebibyte - Pebibyte - Exbibyte - Zebibyte - Yobibyte - Nanosecond - Microsecond - Millisecond - Second - Minute - Hour - Day - Week example: Second description: 'Specifies the units of measure for values displayed in a detector''s chart. Splunk Observability Cloud assumes that the raw data uses the unit of measure you select. For example, the value 1000 in a chart where you''ve set options.publishLabelOption.valueUnit to bits appears as 1 Kilobit, and the value 1024 in a plot set to Bytes appears as 1 Kebibyte. Splunk Observability Cloud scales units within their own unit type. Refer to Display units and other labels for a full specification. The options.publishLabelOptions.valueUnit option applies to scaling and labeling in chart tooltips, axes, and data tables. If options.publishLabelOptions.valueUnit affects the chart presentation, it overrides options.publishLabelOptions.valuePrefix and options.publishLabelOptions.valueSuffix.' description: 'One set of options that control the appearance of a publish() block in a detector''s chart, in the form of a JSON object. Splunk Observability Cloud matches the objects label value to match it to its publish() block.' description: 'List of display options for a detector''s chart. Each element in the list contains the options for a single SignalFlow publish() block in the detector''s SignalFlow program. The list has the form of a JSON array of objects. Splunk Observability Cloud matches an object''s label value to match it to a publish() block.' showDataMarkers: type: boolean default: true readOnly: false writeOnly: false example: true description: If True, visualizations contain markers for each data point. showEventLines: type: boolean default: false readOnly: false writeOnly: false example: true description: 'If True, the visualization contains a vertical line at the time value that the detect() function triggers an alert.' time: title: Time Object type: object properties: end: type: integer format: int64 default: 0 example: 1557693030000 readOnly: false writeOnly: false description: 'The timestamp of the last time to display in the visualization, specified in *nix time in milliseconds.' range: type: integer format: int64 minimum: 0 default: 0 readOnly: false writeOnly: false example: 0 description: 'The number of milliseconds to display in the visualization. This is a is a rolling range with the current time at the right border of the chart display. Use 0 to use the default behavior; this corresponds to -15m for most metrics and -1h for AWS, GCP, and Azure metrics.' start: type: integer format: int64 minimum: 0 default: 0 example: 1557682230000 readOnly: false writeOnly: false description: 'The timestamp of the first time to display in the visualization, specified in *nix time in milliseconds.' type: type: string readOnly: false writeOnly: false enum: - absolute - relative description: 'Enumeration that controls the use of an explicit time range. A value of "absolute" indicates that you want an explicit time range; "relative" indicates that you want the time relative to the last N milliseconds. The default is "relative".' description: Options for the time displayed in the detector visualization. description: Options that control the appearance of a detector in the user interface. description: Properties to use in creating a new detector using the API examples: example: value: authorizedWriters: teams: - DevOps users: - AAXYAAAAAZ4 customProperties: - machineName: dev1 systemId: dev - centerId: oregon centerName: oregonDev description: 'JVM CPU Load detector. Monitors the CPU Load for the JVM, and reports overages. ' detectorOrigin: Standard maxDelay: 60000 minDelay: 60000 name: JVM CPU Load detector packageSpecifications: string parentDetectorId: string programText: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); rules: - description: JVM CPU Load test detectLabel: cpuLoad disabled: false notifications: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow parameterizedBody: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\" triggered\ \ at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\" in detector\ \ \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\n{{#if\ \ anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in the last\ \ {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger threshold:\ \ {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\n{{#notEmpty\ \ dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook:\ \ {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" parameterizedSubject: Notification for {{{rulename}}} in detector {{{detectorName}}} reminderNotification: interval: 300000 timeout: 3600000 type: TIMEOUT runbookUrl: www.example.com severity: Info skipClearNotificationStates: - MANUALLY_RESOLVED - AUTO_RESOLVED tip: Check detector in Splunk Observability Cloud tags: - dev - oregon - offline teams: - DevOps - Engineering - Support timezone: America/Detroit visualizationOptions: disableSampling: false publishLabelOptions: - displayName: JVM CPU load label: cpuLoad paletteIndex: 9 valuePrefix: 'Avg ' valueSuffix: pct valueUnit: Second showDataMarkers: true showEventLines: true time: end: 1557693030000 range: 0 start: 1557682230000 type: absolute responses: '200': description: HTTP 200 response content: application/json: schema: title: Create Detector Response Body type: object properties: created: title: Creation time type: integer format: int64 example: 1556825430000 readOnly: true description: 'The time the detector was created, in *nix time in milliseconds. This property is read-only; it''s always set by the system.' creator: title: Creator user ID type: string example: AAXYAAAAAZ3 readOnly: true description: 'Splunk Observability Cloud ID of the user who created the detector. This property is read-only; it''s always set by the system.' customProperties: title: Custom properties type: object additionalProperties: null readOnly: false writeOnly: false example: property1: detectorArea value1: internal detectors description: Metadata for a detector, in the form of a JSON object. description: title: Detector description type: string readOnly: false writeOnly: false example: jvm CPU load warning description: 'Description of a detector. The value appears in the Detector window displayed in the UI Actions menu.' detectorOrigin: title: How the detector was created type: string enum: - Standard - AutoDetect - AutoDetectCustomization example: Standard default: Standard description: 'Indicates how a detector was created. The possible values are: Standard: Detector created using the API or the user interface. AutoDetect: Detector is an AutoDetect detector created by Splunk Observability Cloud. AutoDetectCustomization: Detector is a customization of another AutoDetect detector. Note: You can only use Standard or AutoDetectCustomization to create custom detectors. If you try to pass an invalid value for detectorOrigin when creating or updating detectors, you receive a "Not valid detector origin" error message in the response.' id: title: Detector system ID type: string readOnly: true description: 'ID of a detector. When you retrieve events or incidents for a detector, this ID is for the detector that generated the event or incident. This property is read-only; it''s always set by the system.' labelResolutions: title: Alert resolution times type: object readOnly: true additionalProperties: type: integer example: DetectorA: 3000 DetectorB: 5000 description: 'Key-value pairs that indicate how often data is analyzed to determine if an alert should be triggered, in the form of a JSON object containing properties. Each key is the label name of a call to publish() in the SignalFlow for the detector, and each value is the resolution time for that publish() block. For example, to retrieve the label resolution of the call to publish("DetectorStatement") from this object, use labelResolutions.DetectorStatement. Label resolution is different from the data display resolution used to populate the detector visualization. The data display resolution is automatically set to the coarsest resolution of all of the SignalFlow publish() calls associated with the detector, since they are all displayed together in the same visualization.' lastUpdated: title: Detector last updated time type: integer format: int64 example: 1557689430000 readOnly: true description: The last time the detector was updated, in *nix time in milliseconds. lastUpdatedBy: title: Detector last updated ID type: string readOnly: true example: ZZyZZZZXXXQ description: 'The ID of the user who last updated the detector. If the system made the last update, the value is "AAAAAAAAAA". This property is read-only; it''s always set by the system.' locked: title: Detector lock state type: boolean example: false description: 'Detector lock state. If true, nobody can modify the detector in any way; otherwise, anyone can modify it.' maxDelay: title: Late-arriving data point delay time type: integer format: int32 minimum: 0 maximum: 900000 default: 0 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait for late-arriving data before continuing the SignalFlow computation for the detector. If data is arriving on time, the computation continues before the duration expires. The default is 0, which tells SignalFlow to set the limit dynamically. To set a duration to wait even if data is arriving on time, use minDelay.' minDelay: title: data point pre-processing delay time type: integer format: int32 minimum: 0 maximum: 900000 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait before continuing the SignalFlow computation for the detector. The computation waits for this duration to expire, even if the data is arriving in a timely fashion. To set a duration to wait for late-arriving data, use maxDelay.' name: title: Detector name (displayed) type: string minLength: 1 readOnly: false writeOnly: false example: JVM CPU Load detector description: 'Displayed name of the detector in the UI. When you retrieve events or incidents, this property contains the name of the associated detector.' overMTSLimit: type: boolean readOnly: true example: false title: OverMTSLimit description: 'If true, one or more statements in a detector matched too many MTS, and the system forcibly limited the detector. This usually occurs when the detector is looking at incomplete data or an incomplete aggregation. When this flag is true, use partition_filter() functions to split your dataset into smaller pieces, then use the union() function to rejoin the results in a subsequent computation. The union() function still observes the MTS limit, so an aggregation of the partial streams must first limit the dataset prior to recombining the streams. This property is read-only; it''s always set by the system.' packageSpecifications: title: SignalFlow internal field type: string default: '' description: For internal use only parentDetectorId: title: ID of the parent AutoDetect detector type: string description: ID of the parent detector from which this detector is customized and created. This property is required for detectors with detectorOrigin of type AutoDetectCustomization. programText: title: SignalFlow program for the detector type: string readOnly: false writeOnly: false example: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); description: 'Specifies the SignalFlow program that defines the detector. This program must include one or more calls to the SignalFlow detect() function. The program must also call publish() on each detect stream, using a label that''s unique to the program. If you want to use custom notification messages that include input data, assign your detect conditions to variables. To use multiple lines in your program, terminate each line with a semicolon ; or newline character \n. To learn more about SignalFlow programs for detectors, see the Detectors topic in the Developers Guide. Note: For detectors with detectorOrigin of type AutoDetectCustomization, it is best practice to keep the same function in the programText property as the parent detector. You can still pass different arguments for the function.' rules: title: Alert Rule Definitions type: array items: title: Detector Rule Object type: object required: - detectLabel - severity properties: description: type: string default: '' readOnly: false writeOnly: false example: JVM CPU Load test title: RuleDescription description: 'Description for the rule. Displays as the alert condition in the Alert Rules tab of the detector editor in the UI' detectLabel: type: string example: cpuLoad title: RuleDetectLabel description: 'Label of the publish() call for the detect() function associated with this rule.' disabled: type: boolean default: false readOnly: false writeOnly: false example: false title: Disabled description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from a detector to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a detector notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string example: https://example.com/alarm/{{incidentId}}?status={{status}} readOnly: false writeOnly: false description: 'The URL of a webhook integration. You can use the Handlebars syntax for this URL. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow title: Notifications description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. To send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' reminderNotification: type: object properties: type: type: string enum: - TIMEOUT example: TIMEOUT description: Type of reminder notifications. The only supported value is TIMEOUT. interval: type: integer format: int64 example: 300000 description: The interval at which you want to receive reminder notifications, in milliseconds. Interval value must be between 5 minutes and 7 days, inclusive. Interval value must be shorter than or equal to the value of timeout. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. timeout: type: integer format: int64 example: 3600000 description: The duration during which you want to receive reminder notifications, in milliseconds. Timeout value must be between 5 minutes and 7 days, inclusive. Timeout value must be longer than or equal to the value of interval. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. title: ReminderNotification description: Set up reminder notifications for your detectors so you can receive multiple notifications for active alerts over a defined period of time. skipClearNotificationStates: type: array items: type: string enum: - OK - AUTO_RESOLVED - STOPPED - MANUALLY_RESOLVED title: AlertClearState description: 'Specifies the different states an alert can transition to when clearing, in the form of a JSON string. These states can be used in the skipClearNotificationStates property to control which types of clear notifications are sent. The possible values are: "OK": The alert is cleared. "AUTO_RESOLVED": The Auto-clear setting is applied to the detector and the specified duration has elapsed. To learn more, see Auto-clear alerts. "STOPPED": The detector is muted or inactive when the alert is triggered. "MANUALLY_RESOLVED": The alert is manually set as resolved during an alert state.' example: - MANUALLY_RESOLVED - AUTO_RESOLVED description: 'Specifies which types of alert clear states should not trigger notifications, in the form of a JSON array of AlertClearState enum values. When an alert clears with one of the specified states, notifications will be suppressed while the alert state and incident data are still updated normally. This allows you to reduce notification noise by selectively suppressing clear notifications based on how the alert was resolved. For example, you might want to suppress notifications when alerts are manually resolved or auto-resolved due to missing data, but still receive notifications when alerts clear naturally (OK state).' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\" triggered\ \ at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\" in detector\ \ \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\n\ {{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in\ \ the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n\ {{/if}}\n\n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if\ \ anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n\ {{/if}}" title: ParameterizedBody description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{rulename}}} in detector {{{detectorName}}} title: ParameterizedSubject description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com title: RunbookUrl description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false title: Severity description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check detector in Splunk Observability Cloud description: 'Plain text to show in the notification message for an alert. Use this text to suggest the first course of action to take when a signal triggers an alert. To show this text, customize the parameterizedBody property to add the {{{tip}}} variable.' description: Single alert rule readOnly: false writeOnly: false status: title: Status of this detector type: string readOnly: true enum: - ABORTED - ACTIVE - INITIALIZING - RETRYING_INITIALIZATION - FAILED example: ACTIVE description: 'Status of the analytics job for this detector. This property is read-only. The possible values are: "ABORTED": The analytics job for this detector has been aborted by the system. "ACTIVE": The analytics job for this detector is up and running. "INITIALIZING": The analytics job for this detector is starting up after creation or re-starting after an update. "RETRYING_INITIALIZATION": The analytics job for this detector failed to start and Splunk Observability Cloud will try to start the job again after some time. "FAILED": The analytics job for this detector failed to start and the system has reached maximum number of initialization attempts.' tags: title: Keyword filters type: array readOnly: false writeOnly: false items: type: string maxLength: 256 maxItems: 50 readOnly: false writeOnly: false description: 'UTF-8 string, starting with an uppercase or lowercase alphabetic character. The maximum length is expressed in characters; if a string consists solely of single-byte UTF-8 entities, 1024 characters are available.' example: - dev - oregon - offline description: 'Array of keywords that filters detectors by one of their properties. Use tags to indicate the state of a detector or its data source (for example, you can label a detector with a "prod" tag to indicate that it monitors a production environment). Note: You can have no more than 50 tags per detector.' teams: title: Team IDs for this detector type: array readOnly: false writeOnly: false items: type: string readOnly: false writeOnly: false example: - DevOps - Engineering - Support description: 'IDs of teams associated with this detector. The teams associated with a detector can see the detector and its active alerts on the team''s landing page in the UI. The list of teams associated with a detector is independent of notification settings. Teams specified in this field don''t automatically get notified of new alerts, and teams that choose to get alerts do not have to display the detector on their team landing page in the web application.' timezone: title: Time zone for SignalFlow calendar window transformations type: string default: UTC readOnly: false writeOnly: false example: America/Detroit description: 'Specifies which time zone SignalFlow should use as the basis of calendar window transformation methods. For example, if you set "timezone": "Europe/Paris" and then use the transformation sum(cycle="week", cycle_start="Monday") in your detector''s SignalFlow program, the calendar window starts on Monday, Paris time. For a list of supported time zones, see Time zone for calendar window transformations.' visualizationOptions: title: Detector appearance options type: object properties: disableSampling: type: boolean default: false readOnly: false writeOnly: false example: false description: 'If true, Splunk Observability Cloud displays all data points in the detect() streams; otherwise, Splunk Observability Cloud only samples data points. Using sampling improves performance.' publishLabelOptions: title: List of display options for the detector's chart type: array items: title: Display options for the detector's chart type: object properties: displayName: title: Detector chart display name type: string example: JVM CPU load description: 'Specifies the Data Table column header for a single publish() block in a detector''s chart. If you don''t specify a value, Splunk Observability Cloud uses the name of the dimension that''s providing the data for the publish() block.' label: title: Label of a publish() object in a SignalFlow program type: string example: cpuLoad description: 'Specifies a SignalFlow publish() object label. Splunk Observability Cloud uses this value to associate the publish() block output with a publishLabelOptions object.' paletteIndex: title: Color choice type: integer minimum: 0 maximum: 15 example: 9 description: '0-based index into the color table displayed in Charts color palettes. Only the first 16 entries (0-15) are allowed for this value. Splunk Observability Cloud uses the index to determine which color to use for displaying the output of a single publish() object in a detector''s table.' valuePrefix: title: String to prepend to data table values type: string example: 'Avg ' description: 'Specifies a string to prepend to the value in a data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point on a chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valuePrefix if you set options.publishLabelOptions.valueUnit for the same plot.' valueSuffix: title: String to append to detector chart's data table values type: string example: pct description: 'Specifies a string to append to the value in the data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point in the chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valueSuffix if you set options.publishLabelOptions.valueUnit for the same plot.' valueUnit: title: Display units used with the detector's chart type: string enum: - Bit - Kilobit - Megabit - Gigabit - Terabit - Petabit - Exabit - Zettabit - Yottabit - Byte - Kibibyte - Mebibyte - Gibibyte - Tebibyte - Pebibyte - Exbibyte - Zebibyte - Yobibyte - Nanosecond - Microsecond - Millisecond - Second - Minute - Hour - Day - Week example: Second description: 'Specifies the units of measure for values displayed in a detector''s chart. Splunk Observability Cloud assumes that the raw data uses the unit of measure you select. For example, the value 1000 in a chart where you''ve set options.publishLabelOption.valueUnit to bits appears as 1 Kilobit, and the value 1024 in a plot set to Bytes appears as 1 Kebibyte. Splunk Observability Cloud scales units within their own unit type. Refer to Display units and other labels for a full specification. The options.publishLabelOptions.valueUnit option applies to scaling and labeling in chart tooltips, axes, and data tables. If options.publishLabelOptions.valueUnit affects the chart presentation, it overrides options.publishLabelOptions.valuePrefix and options.publishLabelOptions.valueSuffix.' description: 'One set of options that control the appearance of a publish() block in a detector''s chart, in the form of a JSON object. Splunk Observability Cloud matches the objects label value to match it to its publish() block.' description: 'List of display options for a detector''s chart. Each element in the list contains the options for a single SignalFlow publish() block in the detector''s SignalFlow program. The list has the form of a JSON array of objects. Splunk Observability Cloud matches an object''s label value to match it to a publish() block.' showDataMarkers: type: boolean default: true readOnly: false writeOnly: false example: true description: If True, visualizations contain markers for each data point. showEventLines: type: boolean default: false readOnly: false writeOnly: false example: true description: 'If True, the visualization contains a vertical line at the time value that the detect() function triggers an alert.' time: title: Time Object type: object properties: end: type: integer format: int64 default: 0 example: 1557693030000 readOnly: false writeOnly: false description: 'The timestamp of the last time to display in the visualization, specified in *nix time in milliseconds.' range: type: integer format: int64 minimum: 0 default: 0 readOnly: false writeOnly: false example: 0 description: 'The number of milliseconds to display in the visualization. This is a is a rolling range with the current time at the right border of the chart display. Use 0 to use the default behavior; this corresponds to -15m for most metrics and -1h for AWS, GCP, and Azure metrics.' start: type: integer format: int64 minimum: 0 default: 0 example: 1557682230000 readOnly: false writeOnly: false description: 'The timestamp of the first time to display in the visualization, specified in *nix time in milliseconds.' type: type: string readOnly: false writeOnly: false enum: - absolute - relative description: 'Enumeration that controls the use of an explicit time range. A value of "absolute" indicates that you want an explicit time range; "relative" indicates that you want the time relative to the last N milliseconds. The default is "relative".' description: Options for the time displayed in the detector visualization. description: Options that control the appearance of a detector in the user interface. description: 'Response body returned when the Create Detector operation (POST /detector) successfully creates a detector. Note: The Validate Detector Definition operation (POST /validate) doesn''t return this response body.' examples: example: value: created: 1556825430000 creator: AAXYAAAAAZ3 customProperties: property1: detectorArea value1: internal detectors description: jvm CPU load warning detectorOrigin: Standard id: string labelResolutions: DetectorA: 3000 DetectorB: 5000 lastUpdated: 1557689430000 lastUpdatedBy: ZZyZZZZXXXQ locked: false maxDelay: 60000 minDelay: 60000 name: JVM CPU Load detector overMTSLimit: false packageSpecifications: string parentDetectorId: string programText: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); rules: - description: JVM CPU Load test detectLabel: cpuLoad disabled: false notifications: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow parameterizedBody: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\"\ \ in detector \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\ \n{{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in\ \ the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\ \n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n\ {{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" parameterizedSubject: Notification for {{{rulename}}} in detector {{{detectorName}}} reminderNotification: interval: 300000 timeout: 3600000 type: TIMEOUT runbookUrl: www.example.com severity: Info skipClearNotificationStates: - MANUALLY_RESOLVED - AUTO_RESOLVED tip: Check detector in Splunk Observability Cloud status: ACTIVE tags: - dev - oregon - offline teams: - DevOps - Engineering - Support timezone: America/Detroit visualizationOptions: disableSampling: false publishLabelOptions: - displayName: JVM CPU load label: cpuLoad paletteIndex: 9 valuePrefix: 'Avg ' valueSuffix: pct valueUnit: Second showDataMarkers: true showEventLines: true time: end: 1557693030000 range: 0 start: 1557682230000 type: absolute '400': description: HTTP 400 response content: application/json: schema: type: object properties: code: type: integer format: int32 description: HTTP response code. Always '400' message: type: string description: Error explanation examples: example: value: code: 0 message: string security: - SessionToken: [] tags: - Detectors /detector/{id}: get: summary: Retrieve Detector ID description: 'Retrieves the properties of the detector that has the ID specified in the {id} path parameter.' parameters: - name: id in: path description: ID for a detector required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Properties for a retrieved detector type: object properties: created: title: Creation time type: integer format: int64 example: 1556825430000 readOnly: true description: 'The time the detector was created, in *nix time in milliseconds. This property is read-only; it''s always set by the system.' creator: title: Creator user ID type: string example: AAXYAAAAAZ3 readOnly: true description: 'Splunk Observability Cloud ID of the user who created the detector. This property is read-only; it''s always set by the system.' customProperties: title: Custom properties type: object additionalProperties: null readOnly: false writeOnly: false example: property1: detectorArea value1: internal detectors description: Metadata for a detector, in the form of a JSON object. description: title: Detector description type: string readOnly: false writeOnly: false example: jvm CPU load warning description: 'Description of a detector. The value appears in the Detector window displayed in the UI Actions menu.' detectorOrigin: title: How the detector was created type: string enum: - Standard - AutoDetect - AutoDetectCustomization example: Standard default: Standard description: 'Indicates how a detector was created. The possible values are: Standard: Detector created using the API or the user interface. AutoDetect: Detector is an AutoDetect detector created by Splunk Observability Cloud. AutoDetectCustomization: Detector is a customization of another AutoDetect detector. Note: You can only use Standard or AutoDetectCustomization to create custom detectors. If you try to pass an invalid value for detectorOrigin when creating or updating detectors, you receive a "Not valid detector origin" error message in the response.' id: title: Detector system ID type: string readOnly: true description: 'ID of a detector. When you retrieve events or incidents for a detector, this ID is for the detector that generated the event or incident. This property is read-only; it''s always set by the system.' labelResolutions: title: Alert resolution times type: object readOnly: true additionalProperties: type: integer example: DetectorA: 3000 DetectorB: 5000 description: 'Key-value pairs that indicate how often data is analyzed to determine if an alert should be triggered, in the form of a JSON object containing properties. Each key is the label name of a call to publish() in the SignalFlow for the detector, and each value is the resolution time for that publish() block. For example, to retrieve the label resolution of the call to publish("DetectorStatement") from this object, use labelResolutions.DetectorStatement. Label resolution is different from the data display resolution used to populate the detector visualization. The data display resolution is automatically set to the coarsest resolution of all of the SignalFlow publish() calls associated with the detector, since they are all displayed together in the same visualization.' lastUpdated: title: Detector last updated time type: integer format: int64 example: 1557689430000 readOnly: true description: The last time the detector was updated, in *nix time in milliseconds. lastUpdatedBy: title: Detector last updated ID type: string readOnly: true example: ZZyZZZZXXXQ description: 'The ID of the user who last updated the detector. If the system made the last update, the value is "AAAAAAAAAA". This property is read-only; it''s always set by the system.' locked: title: Detector lock state type: boolean example: false description: 'Detector lock state. If true, nobody can modify the detector in any way; otherwise, anyone can modify it.' maxDelay: title: Late-arriving data point delay time type: integer format: int32 minimum: 0 maximum: 900000 default: 0 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait for late-arriving data before continuing the SignalFlow computation for the detector. If data is arriving on time, the computation continues before the duration expires. The default is 0, which tells SignalFlow to set the limit dynamically. To set a duration to wait even if data is arriving on time, use minDelay.' name: title: Detector name (displayed) type: string minLength: 1 readOnly: false writeOnly: false example: JVM CPU Load detector description: 'Displayed name of the detector in the UI. When you retrieve events or incidents, this property contains the name of the associated detector.' overMTSLimit: type: boolean readOnly: true example: false title: OverMTSLimit description: 'If true, one or more statements in a detector matched too many MTS, and the system forcibly limited the detector. This usually occurs when the detector is looking at incomplete data or an incomplete aggregation. When this flag is true, use partition_filter() functions to split your dataset into smaller pieces, then use the union() function to rejoin the results in a subsequent computation. The union() function still observes the MTS limit, so an aggregation of the partial streams must first limit the dataset prior to recombining the streams. This property is read-only; it''s always set by the system.' parentDetectorId: title: ID of the parent AutoDetect detector type: string description: ID of the parent detector from which this detector is customized and created. This property is required for detectors with detectorOrigin of type AutoDetectCustomization. programText: title: SignalFlow program for the detector type: string readOnly: false writeOnly: false example: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); description: 'Specifies the SignalFlow program that defines the detector. This program must include one or more calls to the SignalFlow detect() function. The program must also call publish() on each detect stream, using a label that''s unique to the program. If you want to use custom notification messages that include input data, assign your detect conditions to variables. To use multiple lines in your program, terminate each line with a semicolon ; or newline character \n. To learn more about SignalFlow programs for detectors, see the Detectors topic in the Developers Guide. Note: For detectors with detectorOrigin of type AutoDetectCustomization, it is best practice to keep the same function in the programText property as the parent detector. You can still pass different arguments for the function.' rules: title: Alert Rule Definitions type: array items: title: Detector Rule Object type: object required: - detectLabel - severity properties: description: type: string default: '' readOnly: false writeOnly: false example: JVM CPU Load test title: RuleDescription description: 'Description for the rule. Displays as the alert condition in the Alert Rules tab of the detector editor in the UI' detectLabel: type: string example: cpuLoad title: RuleDetectLabel description: 'Label of the publish() call for the detect() function associated with this rule.' disabled: type: boolean default: false readOnly: false writeOnly: false example: false title: Disabled description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from a detector to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a detector notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string example: https://example.com/alarm/{{incidentId}}?status={{status}} readOnly: false writeOnly: false description: 'The URL of a webhook integration. You can use the Handlebars syntax for this URL. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow title: Notifications description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. To send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' reminderNotification: type: object properties: type: type: string enum: - TIMEOUT example: TIMEOUT description: Type of reminder notifications. The only supported value is TIMEOUT. interval: type: integer format: int64 example: 300000 description: The interval at which you want to receive reminder notifications, in milliseconds. Interval value must be between 5 minutes and 7 days, inclusive. Interval value must be shorter than or equal to the value of timeout. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. timeout: type: integer format: int64 example: 3600000 description: The duration during which you want to receive reminder notifications, in milliseconds. Timeout value must be between 5 minutes and 7 days, inclusive. Timeout value must be longer than or equal to the value of interval. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. title: ReminderNotification description: Set up reminder notifications for your detectors so you can receive multiple notifications for active alerts over a defined period of time. skipClearNotificationStates: type: array items: type: string enum: - OK - AUTO_RESOLVED - STOPPED - MANUALLY_RESOLVED title: AlertClearState description: 'Specifies the different states an alert can transition to when clearing, in the form of a JSON string. These states can be used in the skipClearNotificationStates property to control which types of clear notifications are sent. The possible values are: "OK": The alert is cleared. "AUTO_RESOLVED": The Auto-clear setting is applied to the detector and the specified duration has elapsed. To learn more, see Auto-clear alerts. "STOPPED": The detector is muted or inactive when the alert is triggered. "MANUALLY_RESOLVED": The alert is manually set as resolved during an alert state.' example: - MANUALLY_RESOLVED - AUTO_RESOLVED description: 'Specifies which types of alert clear states should not trigger notifications, in the form of a JSON array of AlertClearState enum values. When an alert clears with one of the specified states, notifications will be suppressed while the alert state and incident data are still updated normally. This allows you to reduce notification noise by selectively suppressing clear notifications based on how the alert was resolved. For example, you might want to suppress notifications when alerts are manually resolved or auto-resolved due to missing data, but still receive notifications when alerts clear naturally (OK state).' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\" triggered\ \ at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\" in detector\ \ \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\n\ {{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in\ \ the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n\ {{/if}}\n\n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if\ \ anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n\ {{/if}}" title: ParameterizedBody description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{rulename}}} in detector {{{detectorName}}} title: ParameterizedSubject description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com title: RunbookUrl description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false title: Severity description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check detector in Splunk Observability Cloud description: 'Plain text to show in the notification message for an alert. Use this text to suggest the first course of action to take when a signal triggers an alert. To show this text, customize the parameterizedBody property to add the {{{tip}}} variable.' description: Single alert rule readOnly: false writeOnly: false status: title: Status of this detector type: string readOnly: true enum: - ABORTED - ACTIVE - INITIALIZING - RETRYING_INITIALIZATION - FAILED example: ACTIVE description: 'Status of the analytics job for this detector. This property is read-only. The possible values are: "ABORTED": The analytics job for this detector has been aborted by the system. "ACTIVE": The analytics job for this detector is up and running. "INITIALIZING": The analytics job for this detector is starting up after creation or re-starting after an update. "RETRYING_INITIALIZATION": The analytics job for this detector failed to start and Splunk Observability Cloud will try to start the job again after some time. "FAILED": The analytics job for this detector failed to start and the system has reached maximum number of initialization attempts.' tags: title: Keyword filters type: array readOnly: false writeOnly: false items: type: string maxLength: 256 maxItems: 50 readOnly: false writeOnly: false description: 'UTF-8 string, starting with an uppercase or lowercase alphabetic character. The maximum length is expressed in characters; if a string consists solely of single-byte UTF-8 entities, 1024 characters are available.' example: - dev - oregon - offline description: 'Array of keywords that filters detectors by one of their properties. Use tags to indicate the state of a detector or its data source (for example, you can label a detector with a "prod" tag to indicate that it monitors a production environment). Note: You can have no more than 50 tags per detector.' teams: title: Team IDs for this detector type: array readOnly: false writeOnly: false items: type: string readOnly: false writeOnly: false example: - DevOps - Engineering - Support description: 'IDs of teams associated with this detector. The teams associated with a detector can see the detector and its active alerts on the team''s landing page in the UI. The list of teams associated with a detector is independent of notification settings. Teams specified in this field don''t automatically get notified of new alerts, and teams that choose to get alerts do not have to display the detector on their team landing page in the web application.' timezone: title: Time zone for SignalFlow calendar window transformations type: string default: UTC readOnly: false writeOnly: false example: America/Detroit description: 'Specifies which time zone SignalFlow should use as the basis of calendar window transformation methods. For example, if you set "timezone": "Europe/Paris" and then use the transformation sum(cycle="week", cycle_start="Monday") in your detector''s SignalFlow program, the calendar window starts on Monday, Paris time. For a list of supported time zones, see Time zone for calendar window transformations.' visualizationOptions: title: Detector appearance options type: object properties: disableSampling: type: boolean default: false readOnly: false writeOnly: false example: false description: 'If true, Splunk Observability Cloud displays all data points in the detect() streams; otherwise, Splunk Observability Cloud only samples data points. Using sampling improves performance.' publishLabelOptions: title: List of display options for the detector's chart type: array items: title: Display options for the detector's chart type: object properties: displayName: title: Detector chart display name type: string example: JVM CPU load description: 'Specifies the Data Table column header for a single publish() block in a detector''s chart. If you don''t specify a value, Splunk Observability Cloud uses the name of the dimension that''s providing the data for the publish() block.' label: title: Label of a publish() object in a SignalFlow program type: string example: cpuLoad description: 'Specifies a SignalFlow publish() object label. Splunk Observability Cloud uses this value to associate the publish() block output with a publishLabelOptions object.' paletteIndex: title: Color choice type: integer minimum: 0 maximum: 15 example: 9 description: '0-based index into the color table displayed in Charts color palettes. Only the first 16 entries (0-15) are allowed for this value. Splunk Observability Cloud uses the index to determine which color to use for displaying the output of a single publish() object in a detector''s table.' valuePrefix: title: String to prepend to data table values type: string example: 'Avg ' description: 'Specifies a string to prepend to the value in a data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point on a chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valuePrefix if you set options.publishLabelOptions.valueUnit for the same plot.' valueSuffix: title: String to append to detector chart's data table values type: string example: pct description: 'Specifies a string to append to the value in the data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point in the chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valueSuffix if you set options.publishLabelOptions.valueUnit for the same plot.' valueUnit: title: Display units used with the detector's chart type: string enum: - Bit - Kilobit - Megabit - Gigabit - Terabit - Petabit - Exabit - Zettabit - Yottabit - Byte - Kibibyte - Mebibyte - Gibibyte - Tebibyte - Pebibyte - Exbibyte - Zebibyte - Yobibyte - Nanosecond - Microsecond - Millisecond - Second - Minute - Hour - Day - Week example: Second description: 'Specifies the units of measure for values displayed in a detector''s chart. Splunk Observability Cloud assumes that the raw data uses the unit of measure you select. For example, the value 1000 in a chart where you''ve set options.publishLabelOption.valueUnit to bits appears as 1 Kilobit, and the value 1024 in a plot set to Bytes appears as 1 Kebibyte. Splunk Observability Cloud scales units within their own unit type. Refer to Display units and other labels for a full specification. The options.publishLabelOptions.valueUnit option applies to scaling and labeling in chart tooltips, axes, and data tables. If options.publishLabelOptions.valueUnit affects the chart presentation, it overrides options.publishLabelOptions.valuePrefix and options.publishLabelOptions.valueSuffix.' description: 'One set of options that control the appearance of a publish() block in a detector''s chart, in the form of a JSON object. Splunk Observability Cloud matches the objects label value to match it to its publish() block.' description: 'List of display options for a detector''s chart. Each element in the list contains the options for a single SignalFlow publish() block in the detector''s SignalFlow program. The list has the form of a JSON array of objects. Splunk Observability Cloud matches an object''s label value to match it to a publish() block.' showDataMarkers: type: boolean default: true readOnly: false writeOnly: false example: true description: If True, visualizations contain markers for each data point. showEventLines: type: boolean default: false readOnly: false writeOnly: false example: true description: 'If True, the visualization contains a vertical line at the time value that the detect() function triggers an alert.' time: title: Time Object type: object properties: end: type: integer format: int64 default: 0 example: 1557693030000 readOnly: false writeOnly: false description: 'The timestamp of the last time to display in the visualization, specified in *nix time in milliseconds.' range: type: integer format: int64 minimum: 0 default: 0 readOnly: false writeOnly: false example: 0 description: 'The number of milliseconds to display in the visualization. This is a is a rolling range with the current time at the right border of the chart display. Use 0 to use the default behavior; this corresponds to -15m for most metrics and -1h for AWS, GCP, and Azure metrics.' start: type: integer format: int64 minimum: 0 default: 0 example: 1557682230000 readOnly: false writeOnly: false description: 'The timestamp of the first time to display in the visualization, specified in *nix time in milliseconds.' type: type: string readOnly: false writeOnly: false enum: - absolute - relative description: 'Enumeration that controls the use of an explicit time range. A value of "absolute" indicates that you want an explicit time range; "relative" indicates that you want the time relative to the last N milliseconds. The default is "relative".' description: Options for the time displayed in the detector visualization. description: Options that control the appearance of a detector in the user interface. description: 'Properties of a detector retrieved by a successful GET /detector or GET /detector/{id}, in the form of a JSON object.' examples: example: value: created: 1556825430000 creator: AAXYAAAAAZ3 customProperties: property1: detectorArea value1: internal detectors description: jvm CPU load warning detectorOrigin: Standard id: string labelResolutions: DetectorA: 3000 DetectorB: 5000 lastUpdated: 1557689430000 lastUpdatedBy: ZZyZZZZXXXQ locked: false maxDelay: 60000 name: JVM CPU Load detector overMTSLimit: false parentDetectorId: string programText: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); rules: - description: JVM CPU Load test detectLabel: cpuLoad disabled: false notifications: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow parameterizedBody: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\"\ \ in detector \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\ \n{{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in\ \ the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\ \n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n\ {{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" parameterizedSubject: Notification for {{{rulename}}} in detector {{{detectorName}}} reminderNotification: interval: 300000 timeout: 3600000 type: TIMEOUT runbookUrl: www.example.com severity: Info skipClearNotificationStates: - MANUALLY_RESOLVED - AUTO_RESOLVED tip: Check detector in Splunk Observability Cloud status: ACTIVE tags: - dev - oregon - offline teams: - DevOps - Engineering - Support timezone: America/Detroit visualizationOptions: disableSampling: false publishLabelOptions: - displayName: JVM CPU load label: cpuLoad paletteIndex: 9 valuePrefix: 'Avg ' valueSuffix: pct valueUnit: Second showDataMarkers: true showEventLines: true time: end: 1557693030000 range: 0 start: 1557682230000 type: absolute '400': description: HTTP 400 response content: application/json: schema: type: string examples: example: value: string security: - SessionToken: [] tags: - Detectors put: summary: Update Single Detector description: 'Updates the properties of the detector with the ID specified in the {id} path parameter. Note: You can only update the team, disabled, and notifications fields for detectors that have detectorOrigin value AutoDetect. The PUT /detector/{id} operation has overwrite semantics: For read-write properties, if the value is already specified, a new value in the request body overwrites it. For read-write properties, if the value is already specified, and you don''t specify a value for it, the API removes the property from the detector. Properties that are read-write are annotated in the request body property descriptions. Because of these semantics, you have to explicitly preserve existing values as follows: Send a GET /detector/{id} request to retrieve the existing detector values. Update any read-write properties in the response body with the new values you want to use. Use the response body as the request body in the PUT /detector/{id} operation to update the detector. Note: When you update a detector, Splunk Observability Cloud stops the SignalFlow program associated with the detector and sends a stop notification to all the recipients currently configured for the detector. For detectors with a large number of recipients or a large number of alerts, to avoid sending out stop notifications when you update a detector, mute all the alerts before updating it. After you''ve updated the detector, you can unmute its alerts.' parameters: - name: id in: path description: ID of a detector you want to update required: true schema: type: string - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: 'Authentication token Note: If you''re updating the authorizedWriters property, and your user ID isn''t in authorizedWriters already, then you need to use a session token (User API access token) associated with an administrator.' required: true schema: type: string requestBody: required: true content: application/json: schema: title: Update Detector Request Body type: object properties: authorizedWriters: title: Organizations and teams with write permission for an object type: object properties: teams: type: array items: type: string example: DevOps description: 'List of team IDs that have write access to this object, in the form of a JSON array' users: type: array items: type: string example: AAXYAAAAAZ4 description: 'List of user IDs that have write access to this object, in the form of a JSON array' description: 'If your organization has the write permissions feature enabled, you can use this property to specify the user and team IDs that have write access to the object you''re specifying.' customProperties: title: Custom properties type: object additionalProperties: null readOnly: false writeOnly: false example: property1: detectorArea value1: internal detectors description: Metadata for a detector, in the form of a JSON object. description: title: Detector description type: string readOnly: false writeOnly: false example: jvm CPU load warning description: 'Description of a detector. The value appears in the Detector window displayed in the UI Actions menu.' detectorOrigin: title: How the detector was created type: string enum: - Standard - AutoDetect - AutoDetectCustomization example: Standard default: Standard description: 'Indicates how a detector was created. The possible values are: Standard: Detector created using the API or the user interface. AutoDetect: Detector is an AutoDetect detector created by Splunk Observability Cloud. AutoDetectCustomization: Detector is a customization of another AutoDetect detector. Note: You can only use Standard or AutoDetectCustomization to create custom detectors. If you try to pass an invalid value for detectorOrigin when creating or updating detectors, you receive a "Not valid detector origin" error message in the response.' maxDelay: title: Late-arriving data point delay time type: integer format: int32 minimum: 0 maximum: 900000 default: 0 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait for late-arriving data before continuing the SignalFlow computation for the detector. If data is arriving on time, the computation continues before the duration expires. The default is 0, which tells SignalFlow to set the limit dynamically. To set a duration to wait even if data is arriving on time, use minDelay.' minDelay: title: data point pre-processing delay time type: integer format: int32 minimum: 0 maximum: 900000 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait before continuing the SignalFlow computation for the detector. The computation waits for this duration to expire, even if the data is arriving in a timely fashion. To set a duration to wait for late-arriving data, use maxDelay.' name: title: Detector name (displayed) type: string minLength: 1 readOnly: false writeOnly: false example: JVM CPU Load detector description: 'Displayed name of the detector in the UI. When you retrieve events or incidents, this property contains the name of the associated detector.' packageSpecifications: title: SignalFlow internal field type: string default: '' description: For internal use only parentDetectorId: title: ID of the parent AutoDetect detector type: string description: ID of the parent detector from which this detector is customized and created. This property is required for detectors with detectorOrigin of type AutoDetectCustomization. programText: title: SignalFlow program for the detector type: string readOnly: false writeOnly: false example: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); description: 'Specifies the SignalFlow program that defines the detector. This program must include one or more calls to the SignalFlow detect() function. The program must also call publish() on each detect stream, using a label that''s unique to the program. If you want to use custom notification messages that include input data, assign your detect conditions to variables. To use multiple lines in your program, terminate each line with a semicolon ; or newline character \n. To learn more about SignalFlow programs for detectors, see the Detectors topic in the Developers Guide. Note: For detectors with detectorOrigin of type AutoDetectCustomization, it is best practice to keep the same function in the programText property as the parent detector. You can still pass different arguments for the function.' rules: title: Alert Rule Definitions type: array items: title: Detector Rule Object type: object required: - detectLabel - severity properties: description: type: string default: '' readOnly: false writeOnly: false example: JVM CPU Load test title: RuleDescription description: 'Description for the rule. Displays as the alert condition in the Alert Rules tab of the detector editor in the UI' detectLabel: type: string example: cpuLoad title: RuleDetectLabel description: 'Label of the publish() call for the detect() function associated with this rule.' disabled: type: boolean default: false readOnly: false writeOnly: false example: false title: Disabled description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from a detector to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a detector notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string example: https://example.com/alarm/{{incidentId}}?status={{status}} readOnly: false writeOnly: false description: 'The URL of a webhook integration. You can use the Handlebars syntax for this URL. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow title: Notifications description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. To send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' reminderNotification: type: object properties: type: type: string enum: - TIMEOUT example: TIMEOUT description: Type of reminder notifications. The only supported value is TIMEOUT. interval: type: integer format: int64 example: 300000 description: The interval at which you want to receive reminder notifications, in milliseconds. Interval value must be between 5 minutes and 7 days, inclusive. Interval value must be shorter than or equal to the value of timeout. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. timeout: type: integer format: int64 example: 3600000 description: The duration during which you want to receive reminder notifications, in milliseconds. Timeout value must be between 5 minutes and 7 days, inclusive. Timeout value must be longer than or equal to the value of interval. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. title: ReminderNotification description: Set up reminder notifications for your detectors so you can receive multiple notifications for active alerts over a defined period of time. skipClearNotificationStates: type: array items: type: string enum: - OK - AUTO_RESOLVED - STOPPED - MANUALLY_RESOLVED title: AlertClearState description: 'Specifies the different states an alert can transition to when clearing, in the form of a JSON string. These states can be used in the skipClearNotificationStates property to control which types of clear notifications are sent. The possible values are: "OK": The alert is cleared. "AUTO_RESOLVED": The Auto-clear setting is applied to the detector and the specified duration has elapsed. To learn more, see Auto-clear alerts. "STOPPED": The detector is muted or inactive when the alert is triggered. "MANUALLY_RESOLVED": The alert is manually set as resolved during an alert state.' example: - MANUALLY_RESOLVED - AUTO_RESOLVED description: 'Specifies which types of alert clear states should not trigger notifications, in the form of a JSON array of AlertClearState enum values. When an alert clears with one of the specified states, notifications will be suppressed while the alert state and incident data are still updated normally. This allows you to reduce notification noise by selectively suppressing clear notifications based on how the alert was resolved. For example, you might want to suppress notifications when alerts are manually resolved or auto-resolved due to missing data, but still receive notifications when alerts clear naturally (OK state).' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\" triggered\ \ at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\" in detector\ \ \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\n{{#if\ \ anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in the\ \ last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\ \n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n\ {{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" title: ParameterizedBody description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{rulename}}} in detector {{{detectorName}}} title: ParameterizedSubject description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com title: RunbookUrl description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false title: Severity description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check detector in Splunk Observability Cloud description: 'Plain text to show in the notification message for an alert. Use this text to suggest the first course of action to take when a signal triggers an alert. To show this text, customize the parameterizedBody property to add the {{{tip}}} variable.' description: Single alert rule readOnly: false writeOnly: false tags: title: Keyword filters type: array readOnly: false writeOnly: false items: type: string maxLength: 256 maxItems: 50 readOnly: false writeOnly: false description: 'UTF-8 string, starting with an uppercase or lowercase alphabetic character. The maximum length is expressed in characters; if a string consists solely of single-byte UTF-8 entities, 1024 characters are available.' example: - dev - oregon - offline description: 'Array of keywords that filters detectors by one of their properties. Use tags to indicate the state of a detector or its data source (for example, you can label a detector with a "prod" tag to indicate that it monitors a production environment). Note: You can have no more than 50 tags per detector.' teams: title: Team IDs for this detector type: array readOnly: false writeOnly: false items: type: string readOnly: false writeOnly: false example: - DevOps - Engineering - Support description: 'IDs of teams associated with this detector. The teams associated with a detector can see the detector and its active alerts on the team''s landing page in the UI. The list of teams associated with a detector is independent of notification settings. Teams specified in this field don''t automatically get notified of new alerts, and teams that choose to get alerts do not have to display the detector on their team landing page in the web application.' timezone: title: Time zone for SignalFlow calendar window transformations type: string default: UTC readOnly: false writeOnly: false example: America/Detroit description: 'Specifies which time zone SignalFlow should use as the basis of calendar window transformation methods. For example, if you set "timezone": "Europe/Paris" and then use the transformation sum(cycle="week", cycle_start="Monday") in your detector''s SignalFlow program, the calendar window starts on Monday, Paris time. For a list of supported time zones, see Time zone for calendar window transformations.' visualizationOptions: title: Detector appearance options type: object properties: disableSampling: type: boolean default: false readOnly: false writeOnly: false example: false description: 'If true, Splunk Observability Cloud displays all data points in the detect() streams; otherwise, Splunk Observability Cloud only samples data points. Using sampling improves performance.' publishLabelOptions: title: List of display options for the detector's chart type: array items: title: Display options for the detector's chart type: object properties: displayName: title: Detector chart display name type: string example: JVM CPU load description: 'Specifies the Data Table column header for a single publish() block in a detector''s chart. If you don''t specify a value, Splunk Observability Cloud uses the name of the dimension that''s providing the data for the publish() block.' label: title: Label of a publish() object in a SignalFlow program type: string example: cpuLoad description: 'Specifies a SignalFlow publish() object label. Splunk Observability Cloud uses this value to associate the publish() block output with a publishLabelOptions object.' paletteIndex: title: Color choice type: integer minimum: 0 maximum: 15 example: 9 description: '0-based index into the color table displayed in Charts color palettes. Only the first 16 entries (0-15) are allowed for this value. Splunk Observability Cloud uses the index to determine which color to use for displaying the output of a single publish() object in a detector''s table.' valuePrefix: title: String to prepend to data table values type: string example: 'Avg ' description: 'Specifies a string to prepend to the value in a data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point on a chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valuePrefix if you set options.publishLabelOptions.valueUnit for the same plot.' valueSuffix: title: String to append to detector chart's data table values type: string example: pct description: 'Specifies a string to append to the value in the data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point in the chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valueSuffix if you set options.publishLabelOptions.valueUnit for the same plot.' valueUnit: title: Display units used with the detector's chart type: string enum: - Bit - Kilobit - Megabit - Gigabit - Terabit - Petabit - Exabit - Zettabit - Yottabit - Byte - Kibibyte - Mebibyte - Gibibyte - Tebibyte - Pebibyte - Exbibyte - Zebibyte - Yobibyte - Nanosecond - Microsecond - Millisecond - Second - Minute - Hour - Day - Week example: Second description: 'Specifies the units of measure for values displayed in a detector''s chart. Splunk Observability Cloud assumes that the raw data uses the unit of measure you select. For example, the value 1000 in a chart where you''ve set options.publishLabelOption.valueUnit to bits appears as 1 Kilobit, and the value 1024 in a plot set to Bytes appears as 1 Kebibyte. Splunk Observability Cloud scales units within their own unit type. Refer to Display units and other labels for a full specification. The options.publishLabelOptions.valueUnit option applies to scaling and labeling in chart tooltips, axes, and data tables. If options.publishLabelOptions.valueUnit affects the chart presentation, it overrides options.publishLabelOptions.valuePrefix and options.publishLabelOptions.valueSuffix.' description: 'One set of options that control the appearance of a publish() block in a detector''s chart, in the form of a JSON object. Splunk Observability Cloud matches the objects label value to match it to its publish() block.' description: 'List of display options for a detector''s chart. Each element in the list contains the options for a single SignalFlow publish() block in the detector''s SignalFlow program. The list has the form of a JSON array of objects. Splunk Observability Cloud matches an object''s label value to match it to a publish() block.' showDataMarkers: type: boolean default: true readOnly: false writeOnly: false example: true description: If True, visualizations contain markers for each data point. showEventLines: type: boolean default: false readOnly: false writeOnly: false example: true description: 'If True, the visualization contains a vertical line at the time value that the detect() function triggers an alert.' time: title: Time Object type: object properties: end: type: integer format: int64 default: 0 example: 1557693030000 readOnly: false writeOnly: false description: 'The timestamp of the last time to display in the visualization, specified in *nix time in milliseconds.' range: type: integer format: int64 minimum: 0 default: 0 readOnly: false writeOnly: false example: 0 description: 'The number of milliseconds to display in the visualization. This is a is a rolling range with the current time at the right border of the chart display. Use 0 to use the default behavior; this corresponds to -15m for most metrics and -1h for AWS, GCP, and Azure metrics.' start: type: integer format: int64 minimum: 0 default: 0 example: 1557682230000 readOnly: false writeOnly: false description: 'The timestamp of the first time to display in the visualization, specified in *nix time in milliseconds.' type: type: string readOnly: false writeOnly: false enum: - absolute - relative description: 'Enumeration that controls the use of an explicit time range. A value of "absolute" indicates that you want an explicit time range; "relative" indicates that you want the time relative to the last N milliseconds. The default is "relative".' description: Options for the time displayed in the detector visualization. description: Options that control the appearance of a detector in the user interface. description: Overwritable properties you can include in a request to update a detector examples: example: value: authorizedWriters: teams: - DevOps users: - AAXYAAAAAZ4 customProperties: property1: detectorArea value1: internal detectors description: jvm CPU load warning detectorOrigin: Standard maxDelay: 60000 minDelay: 60000 name: JVM CPU Load detector packageSpecifications: string parentDetectorId: string programText: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); rules: - description: JVM CPU Load test detectLabel: cpuLoad disabled: false notifications: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow parameterizedBody: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\" triggered\ \ at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\" in detector\ \ \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\n{{#if\ \ anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in the last\ \ {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger threshold:\ \ {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\n{{#notEmpty\ \ dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook:\ \ {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" parameterizedSubject: Notification for {{{rulename}}} in detector {{{detectorName}}} reminderNotification: interval: 300000 timeout: 3600000 type: TIMEOUT runbookUrl: www.example.com severity: Info skipClearNotificationStates: - MANUALLY_RESOLVED - AUTO_RESOLVED tip: Check detector in Splunk Observability Cloud tags: - dev - oregon - offline teams: - DevOps - Engineering - Support timezone: America/Detroit visualizationOptions: disableSampling: false publishLabelOptions: - displayName: JVM CPU load label: cpuLoad paletteIndex: 9 valuePrefix: 'Avg ' valueSuffix: pct valueUnit: Second showDataMarkers: true showEventLines: true time: end: 1557693030000 range: 0 start: 1557682230000 type: absolute responses: '200': description: HTTP 200 response content: application/json: schema: title: Update Detector Response Body type: object properties: created: title: Creation time type: integer format: int64 example: 1556825430000 readOnly: true description: 'The time the detector was created, in *nix time in milliseconds. This property is read-only; it''s always set by the system.' creator: title: Creator user ID type: string example: AAXYAAAAAZ3 readOnly: true description: 'Splunk Observability Cloud ID of the user who created the detector. This property is read-only; it''s always set by the system.' customProperties: title: Custom properties type: object additionalProperties: null readOnly: false writeOnly: false example: property1: detectorArea value1: internal detectors description: Metadata for a detector, in the form of a JSON object. description: title: Detector description type: string readOnly: false writeOnly: false example: jvm CPU load warning description: 'Description of a detector. The value appears in the Detector window displayed in the UI Actions menu.' detectorOrigin: title: How the detector was created type: string enum: - Standard - AutoDetect - AutoDetectCustomization example: Standard default: Standard description: 'Indicates how a detector was created. The possible values are: Standard: Detector created using the API or the user interface. AutoDetect: Detector is an AutoDetect detector created by Splunk Observability Cloud. AutoDetectCustomization: Detector is a customization of another AutoDetect detector. Note: You can only use Standard or AutoDetectCustomization to create custom detectors. If you try to pass an invalid value for detectorOrigin when creating or updating detectors, you receive a "Not valid detector origin" error message in the response.' id: title: Detector system ID type: string readOnly: true description: 'ID of a detector. When you retrieve events or incidents for a detector, this ID is for the detector that generated the event or incident. This property is read-only; it''s always set by the system.' labelResolutions: title: Alert resolution times type: object readOnly: true additionalProperties: type: integer example: DetectorA: 3000 DetectorB: 5000 description: 'Key-value pairs that indicate how often data is analyzed to determine if an alert should be triggered, in the form of a JSON object containing properties. Each key is the label name of a call to publish() in the SignalFlow for the detector, and each value is the resolution time for that publish() block. For example, to retrieve the label resolution of the call to publish("DetectorStatement") from this object, use labelResolutions.DetectorStatement. Label resolution is different from the data display resolution used to populate the detector visualization. The data display resolution is automatically set to the coarsest resolution of all of the SignalFlow publish() calls associated with the detector, since they are all displayed together in the same visualization.' lastUpdated: title: Detector last updated time type: integer format: int64 example: 1557689430000 readOnly: true description: The last time the detector was updated, in *nix time in milliseconds. lastUpdatedBy: title: Detector last updated ID type: string readOnly: true example: ZZyZZZZXXXQ description: 'The ID of the user who last updated the detector. If the system made the last update, the value is "AAAAAAAAAA". This property is read-only; it''s always set by the system.' locked: title: Detector lock state type: boolean example: false description: 'Detector lock state. If true, nobody can modify the detector in any way; otherwise, anyone can modify it.' maxDelay: title: Late-arriving data point delay time type: integer format: int32 minimum: 0 maximum: 900000 default: 0 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait for late-arriving data before continuing the SignalFlow computation for the detector. If data is arriving on time, the computation continues before the duration expires. The default is 0, which tells SignalFlow to set the limit dynamically. To set a duration to wait even if data is arriving on time, use minDelay.' minDelay: title: data point pre-processing delay time type: integer format: int32 minimum: 0 maximum: 900000 readOnly: false writeOnly: false example: 60000 description: 'Sets a duration, in milliseconds, to wait before continuing the SignalFlow computation for the detector. The computation waits for this duration to expire, even if the data is arriving in a timely fashion. To set a duration to wait for late-arriving data, use maxDelay.' name: title: Detector name (displayed) type: string minLength: 1 readOnly: false writeOnly: false example: JVM CPU Load detector description: 'Displayed name of the detector in the UI. When you retrieve events or incidents, this property contains the name of the associated detector.' overMTSLimit: type: boolean readOnly: true example: false title: OverMTSLimit description: 'If true, one or more statements in a detector matched too many MTS, and the system forcibly limited the detector. This usually occurs when the detector is looking at incomplete data or an incomplete aggregation. When this flag is true, use partition_filter() functions to split your dataset into smaller pieces, then use the union() function to rejoin the results in a subsequent computation. The union() function still observes the MTS limit, so an aggregation of the partial streams must first limit the dataset prior to recombining the streams. This property is read-only; it''s always set by the system.' parentDetectorId: title: ID of the parent AutoDetect detector type: string description: ID of the parent detector from which this detector is customized and created. This property is required for detectors with detectorOrigin of type AutoDetectCustomization. programText: title: SignalFlow program for the detector type: string readOnly: false writeOnly: false example: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); description: 'Specifies the SignalFlow program that defines the detector. This program must include one or more calls to the SignalFlow detect() function. The program must also call publish() on each detect stream, using a label that''s unique to the program. If you want to use custom notification messages that include input data, assign your detect conditions to variables. To use multiple lines in your program, terminate each line with a semicolon ; or newline character \n. To learn more about SignalFlow programs for detectors, see the Detectors topic in the Developers Guide. Note: For detectors with detectorOrigin of type AutoDetectCustomization, it is best practice to keep the same function in the programText property as the parent detector. You can still pass different arguments for the function.' rules: title: Alert Rule Definitions type: array items: title: Detector Rule Object type: object required: - detectLabel - severity properties: description: type: string default: '' readOnly: false writeOnly: false example: JVM CPU Load test title: RuleDescription description: 'Description for the rule. Displays as the alert condition in the Alert Rules tab of the detector editor in the UI' detectLabel: type: string example: cpuLoad title: RuleDetectLabel description: 'Label of the publish() call for the detect() function associated with this rule.' disabled: type: boolean default: false readOnly: false writeOnly: false example: false title: Disabled description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from a detector to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a detector notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string example: https://example.com/alarm/{{incidentId}}?status={{status}} readOnly: false writeOnly: false description: 'The URL of a webhook integration. You can use the Handlebars syntax for this URL. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow title: Notifications description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. To send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' reminderNotification: type: object properties: type: type: string enum: - TIMEOUT example: TIMEOUT description: Type of reminder notifications. The only supported value is TIMEOUT. interval: type: integer format: int64 example: 300000 description: The interval at which you want to receive reminder notifications, in milliseconds. Interval value must be between 5 minutes and 7 days, inclusive. Interval value must be shorter than or equal to the value of timeout. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. timeout: type: integer format: int64 example: 3600000 description: The duration during which you want to receive reminder notifications, in milliseconds. Timeout value must be between 5 minutes and 7 days, inclusive. Timeout value must be longer than or equal to the value of interval. The minimum resolution is minutes. For example, you can’t specify this value as 5 minutes and 1 second. title: ReminderNotification description: Set up reminder notifications for your detectors so you can receive multiple notifications for active alerts over a defined period of time. skipClearNotificationStates: type: array items: type: string enum: - OK - AUTO_RESOLVED - STOPPED - MANUALLY_RESOLVED title: AlertClearState description: 'Specifies the different states an alert can transition to when clearing, in the form of a JSON string. These states can be used in the skipClearNotificationStates property to control which types of clear notifications are sent. The possible values are: "OK": The alert is cleared. "AUTO_RESOLVED": The Auto-clear setting is applied to the detector and the specified duration has elapsed. To learn more, see Auto-clear alerts. "STOPPED": The detector is muted or inactive when the alert is triggered. "MANUALLY_RESOLVED": The alert is manually set as resolved during an alert state.' example: - MANUALLY_RESOLVED - AUTO_RESOLVED description: 'Specifies which types of alert clear states should not trigger notifications, in the form of a JSON array of AlertClearState enum values. When an alert clears with one of the specified states, notifications will be suppressed while the alert state and incident data are still updated normally. This allows you to reduce notification noise by selectively suppressing clear notifications based on how the alert was resolved. For example, you might want to suppress notifications when alerts are manually resolved or auto-resolved due to missing data, but still receive notifications when alerts clear naturally (OK state).' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\" triggered\ \ at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\" in detector\ \ \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\n\ {{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in\ \ the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n\ {{/if}}\n\n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if\ \ anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n\ {{/if}}" title: ParameterizedBody description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{rulename}}} in detector {{{detectorName}}} title: ParameterizedSubject description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com title: RunbookUrl description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false title: Severity description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check detector in Splunk Observability Cloud description: 'Plain text to show in the notification message for an alert. Use this text to suggest the first course of action to take when a signal triggers an alert. To show this text, customize the parameterizedBody property to add the {{{tip}}} variable.' description: Single alert rule readOnly: false writeOnly: false status: title: Status of this detector type: string readOnly: true enum: - ABORTED - ACTIVE - INITIALIZING - RETRYING_INITIALIZATION - FAILED example: ACTIVE description: 'Status of the analytics job for this detector. This property is read-only. The possible values are: "ABORTED": The analytics job for this detector has been aborted by the system. "ACTIVE": The analytics job for this detector is up and running. "INITIALIZING": The analytics job for this detector is starting up after creation or re-starting after an update. "RETRYING_INITIALIZATION": The analytics job for this detector failed to start and Splunk Observability Cloud will try to start the job again after some time. "FAILED": The analytics job for this detector failed to start and the system has reached maximum number of initialization attempts.' tags: title: Keyword filters type: array readOnly: false writeOnly: false items: type: string maxLength: 256 maxItems: 50 readOnly: false writeOnly: false description: 'UTF-8 string, starting with an uppercase or lowercase alphabetic character. The maximum length is expressed in characters; if a string consists solely of single-byte UTF-8 entities, 1024 characters are available.' example: - dev - oregon - offline description: 'Array of keywords that filters detectors by one of their properties. Use tags to indicate the state of a detector or its data source (for example, you can label a detector with a "prod" tag to indicate that it monitors a production environment). Note: You can have no more than 50 tags per detector.' teams: title: Team IDs for this detector type: array readOnly: false writeOnly: false items: type: string readOnly: false writeOnly: false example: - DevOps - Engineering - Support description: 'IDs of teams associated with this detector. The teams associated with a detector can see the detector and its active alerts on the team''s landing page in the UI. The list of teams associated with a detector is independent of notification settings. Teams specified in this field don''t automatically get notified of new alerts, and teams that choose to get alerts do not have to display the detector on their team landing page in the web application.' timezone: title: Time zone for SignalFlow calendar window transformations type: string default: UTC readOnly: false writeOnly: false example: America/Detroit description: 'Specifies which time zone SignalFlow should use as the basis of calendar window transformation methods. For example, if you set "timezone": "Europe/Paris" and then use the transformation sum(cycle="week", cycle_start="Monday") in your detector''s SignalFlow program, the calendar window starts on Monday, Paris time. For a list of supported time zones, see Time zone for calendar window transformations.' visualizationOptions: title: Detector appearance options type: object properties: disableSampling: type: boolean default: false readOnly: false writeOnly: false example: false description: 'If true, Splunk Observability Cloud displays all data points in the detect() streams; otherwise, Splunk Observability Cloud only samples data points. Using sampling improves performance.' publishLabelOptions: title: List of display options for the detector's chart type: array items: title: Display options for the detector's chart type: object properties: displayName: title: Detector chart display name type: string example: JVM CPU load description: 'Specifies the Data Table column header for a single publish() block in a detector''s chart. If you don''t specify a value, Splunk Observability Cloud uses the name of the dimension that''s providing the data for the publish() block.' label: title: Label of a publish() object in a SignalFlow program type: string example: cpuLoad description: 'Specifies a SignalFlow publish() object label. Splunk Observability Cloud uses this value to associate the publish() block output with a publishLabelOptions object.' paletteIndex: title: Color choice type: integer minimum: 0 maximum: 15 example: 9 description: '0-based index into the color table displayed in Charts color palettes. Only the first 16 entries (0-15) are allowed for this value. Splunk Observability Cloud uses the index to determine which color to use for displaying the output of a single publish() object in a detector''s table.' valuePrefix: title: String to prepend to data table values type: string example: 'Avg ' description: 'Specifies a string to prepend to the value in a data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point on a chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valuePrefix if you set options.publishLabelOptions.valueUnit for the same plot.' valueSuffix: title: String to append to detector chart's data table values type: string example: pct description: 'Specifies a string to append to the value in the data table for a detector''s chart. This string also appears in the tooltip you see when you hover over a point in the chart. To learn more, see the example in Single value charts. Splunk Observability Cloud overrides valueSuffix if you set options.publishLabelOptions.valueUnit for the same plot.' valueUnit: title: Display units used with the detector's chart type: string enum: - Bit - Kilobit - Megabit - Gigabit - Terabit - Petabit - Exabit - Zettabit - Yottabit - Byte - Kibibyte - Mebibyte - Gibibyte - Tebibyte - Pebibyte - Exbibyte - Zebibyte - Yobibyte - Nanosecond - Microsecond - Millisecond - Second - Minute - Hour - Day - Week example: Second description: 'Specifies the units of measure for values displayed in a detector''s chart. Splunk Observability Cloud assumes that the raw data uses the unit of measure you select. For example, the value 1000 in a chart where you''ve set options.publishLabelOption.valueUnit to bits appears as 1 Kilobit, and the value 1024 in a plot set to Bytes appears as 1 Kebibyte. Splunk Observability Cloud scales units within their own unit type. Refer to Display units and other labels for a full specification. The options.publishLabelOptions.valueUnit option applies to scaling and labeling in chart tooltips, axes, and data tables. If options.publishLabelOptions.valueUnit affects the chart presentation, it overrides options.publishLabelOptions.valuePrefix and options.publishLabelOptions.valueSuffix.' description: 'One set of options that control the appearance of a publish() block in a detector''s chart, in the form of a JSON object. Splunk Observability Cloud matches the objects label value to match it to its publish() block.' description: 'List of display options for a detector''s chart. Each element in the list contains the options for a single SignalFlow publish() block in the detector''s SignalFlow program. The list has the form of a JSON array of objects. Splunk Observability Cloud matches an object''s label value to match it to a publish() block.' showDataMarkers: type: boolean default: true readOnly: false writeOnly: false example: true description: If True, visualizations contain markers for each data point. showEventLines: type: boolean default: false readOnly: false writeOnly: false example: true description: 'If True, the visualization contains a vertical line at the time value that the detect() function triggers an alert.' time: title: Time Object type: object properties: end: type: integer format: int64 default: 0 example: 1557693030000 readOnly: false writeOnly: false description: 'The timestamp of the last time to display in the visualization, specified in *nix time in milliseconds.' range: type: integer format: int64 minimum: 0 default: 0 readOnly: false writeOnly: false example: 0 description: 'The number of milliseconds to display in the visualization. This is a is a rolling range with the current time at the right border of the chart display. Use 0 to use the default behavior; this corresponds to -15m for most metrics and -1h for AWS, GCP, and Azure metrics.' start: type: integer format: int64 minimum: 0 default: 0 example: 1557682230000 readOnly: false writeOnly: false description: 'The timestamp of the first time to display in the visualization, specified in *nix time in milliseconds.' type: type: string readOnly: false writeOnly: false enum: - absolute - relative description: 'Enumeration that controls the use of an explicit time range. A value of "absolute" indicates that you want an explicit time range; "relative" indicates that you want the time relative to the last N milliseconds. The default is "relative".' description: Options for the time displayed in the detector visualization. description: Options that control the appearance of a detector in the user interface. description: 'Response body returned when the Update Single Detector operation (PUT /detector/{id}) successfully creates a detector. Note: The Enable Single Detector (PUT /detector/{id}/enable) and Disable Single Detector (PUT /detector/{id}/disable) don''t return this response body.' examples: example: value: created: 1556825430000 creator: AAXYAAAAAZ3 customProperties: property1: detectorArea value1: internal detectors description: jvm CPU load warning detectorOrigin: Standard id: string labelResolutions: DetectorA: 3000 DetectorB: 5000 lastUpdated: 1557689430000 lastUpdatedBy: ZZyZZZZXXXQ locked: false maxDelay: 60000 minDelay: 60000 name: JVM CPU Load detector overMTSLimit: false parentDetectorId: string programText: cpuLoad = data('jvm.cpu.load').percentile(pct=94).publish(label='cpuLoad'); detect(when(cpuLoad > 94)).publish('cpuLoad'); rules: - description: JVM CPU Load test detectLabel: cpuLoad disabled: false notifications: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow parameterizedBody: "{{#if anomalous}}\n\tRule \"{{{ruleName}}}\" in detector \"{{{detectorName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tRule \"{{{ruleName}}}\"\ \ in detector \"{{{detectorName}}}\" cleared at {{dateTimeFormat timestamp format=\"full\"}}.\n{{/if}}\n\ \n{{#if anomalous}}\nTriggering condition: {{{readableRule}}}\n{{/if}}\n\nMean value of signal in\ \ the last {{event_annotations.current_window}}: {{inputs.summary.value}}\n{{#if anomalous}}Trigger\ \ threshold: {{inputs.fire_top.value}}\n{{else}}Clear threshold: {{inputs.clear_top.value}}.\n{{/if}}\n\ \n{{#notEmpty dimensions}}\nSignal details:\n{{{dimensions}}}\n{{/notEmpty}}\n\n{{#if anomalous}}\n\ {{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" parameterizedSubject: Notification for {{{rulename}}} in detector {{{detectorName}}} reminderNotification: interval: 300000 timeout: 3600000 type: TIMEOUT runbookUrl: www.example.com severity: Info skipClearNotificationStates: - MANUALLY_RESOLVED - AUTO_RESOLVED tip: Check detector in Splunk Observability Cloud status: ACTIVE tags: - dev - oregon - offline teams: - DevOps - Engineering - Support timezone: America/Detroit visualizationOptions: disableSampling: false publishLabelOptions: - displayName: JVM CPU load label: cpuLoad paletteIndex: 9 valuePrefix: 'Avg ' valueSuffix: pct valueUnit: Second showDataMarkers: true showEventLines: true time: end: 1557693030000 range: 0 start: 1557682230000 type: absolute '400': description: HTTP 400 response content: application/json: schema: type: object properties: code: type: integer format: int32 description: HTTP response code. Always '400' message: type: string description: Error explanation examples: example: value: code: 0 message: string security: - SessionToken: [] tags: - Detectors delete: summary: Delete Single Detector description: 'Deletes the detector specified by the {id} path parameter. Note: When you delete a detector, Splunk Observability Cloud stops the SignalFlow program associated with the detector and sends a stop notification to all the recipients currently configured for the detector. For detectors with a large number of recipients or a large number of alerts, to avoid sending out stop notifications, delete all the recipients from the detector before you delete the detector. When the detector has no recipients, Splunk Observability Cloud doesn’t send out any notification.' parameters: - name: id in: path description: 'ID of the detector you want to delete. Using the API, you can retrieve this value using GET /v2/detector with the detector''s name.' required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string responses: '204': description: HTTP 204 response '400': description: HTTP 400 response content: application/json: schema: type: object properties: code: type: integer description: HTTP response code. Always '400'. message: type: string example: code: 400 message: Invalid ID junkID examples: example: value: code: 400 message: Invalid ID junkID '401': description: HTTP 401 response content: application/json: schema: type: string examples: default: value: Invalid token specified. security: - SessionToken: [] tags: - Detectors /detector/{id}/disable: put: summary: Disable Detect Blocks parameters: - name: id in: path description: 'Detector ID of the detector that contains the detect() blocks you want to disable. Using the API, you can retrieve this value using GET /v2/detector with the detector''s name.' required: true schema: type: string - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string requestBody: required: true content: application/json: schema: type: array items: type: string description: Label of a detect() block you want to disable examples: example: value: - string responses: '204': description: HTTP 204 response '400': description: HTTP 400 response content: application/json: schema: type: object properties: code: type: integer description: HTTP response code. Always 400. message: type: string description: Text that describes the error. examples: default: value: code: 400 message: 'Label not found in detector: invalidLabel' '401': description: HTTP 401 response content: application/json: schema: type: string examples: default: value: Invalid token specified. security: - SessionToken: [] tags: - Detectors /detector/{id}/enable: put: summary: Enable Detect Blocks description: 'Enables detect() blocks in the detector specified by the {id} path parameter. You can use PUT /detector/{id}/enable with both Standard and AutoDetect detectors. When you enable a disabled detect() block, it starts creating events again. If you muted notifications for dimensions or properties associated with this detect() block, you have to unmute them separately. Sending this request for a detect() block that''s already enabled doesn''t return an error, and the detector remains enabled. You can make the request without first checking the current state of the detector. Enabling a detect() block doesn''t clear active alerts. Instead, Splunk Observability Cloud keeps them until after you clear the condition in the signal that first triggered the block. To learn more about enabling and unmuting, see the section Notification muting. This request doesn''t return a response body.' parameters: - name: id in: path description: 'Detector ID of the detector that contains the detect() blocks you want to enable. Using the API, you can retrieve this value using GET /v2/detector with the detector''s name.' required: true schema: type: string - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string requestBody: required: true content: application/json: schema: type: array items: type: string description: Label of a detect() block you want to enable examples: example: value: - string responses: '204': description: HTTP 204 response '400': description: HTTP 400 response content: application/json: schema: type: object properties: code: type: integer description: HTTP response code. Always 400. message: type: string description: Text that describes the error. examples: default: value: code: 400 message: 'Label not found in detector: invalidLabel' '401': description: HTTP 401 response content: application/json: schema: type: string examples: default: value: Invalid token specified. security: - SessionToken: [] tags: - Detectors /detector/{id}/events: get: summary: Retrieve Events Single Detector description: 'Retrieves the events generated by the detector identified by the id path parameter. Note: Splunk Observability Cloud returns a maximum of 10,000 events, even if your organization contains more than 10,000. To learn more, see the Considerations for retrieve operations section in the developer guide.' parameters: - name: id in: path description: 'The ID of the detector that generated the events you want to retrieve.' required: true schema: type: string - name: from in: query description: 'The starting timestamp, inclusive, of the range of events you want to retrieve, in *nix time in milliseconds.' schema: type: integer format: int64 - name: to in: query description: 'The ending timestamp, inclusive, for the time range of events you want to retrieve, in *nix time in milliseconds.' schema: type: integer format: int64 - name: offset in: query description: 'The index in the query results at which you want to start getting results' schema: type: integer minimum: 0 - name: limit in: query description: Number of query results to return. By default, the API returns 50 detector events. If you want to retrieve a different number of detector events, change the limit value. schema: type: integer format: int32 default: 50 minimum: 0 - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Events for a detector type: array items: title: Single event for a detector type: object properties: anomalyState: type: string enum: - ANOMALOUS - MANUALLY_RESOLVED - OK - STOPPED readOnly: true title: AnomalyState description: 'Describes the current anomaly state of an event or incident, in the form of a JSON string that describes the current signal status compared to its expected state. This property is read-only. The possible values are: "ANOMALOUS": Based on detector settings, Splunk Observability Cloud detected an anomaly and issued events in this incident. "MANUALLY_RESOLVED": User resolved the incident in the UI or by calling PUT /incident/{id}/clear. "OK": Based on the detector settings, Splunk Observability Cloud detected that the anomaly had cleared and issued a clear event for the incident. "STOPPED": User updated the detector and restarted the detector job' detectLabel: title: Publish object label type: string example: loadWarning description: 'Label of the publish object for the detector that generated this event. The publish object is the part of the detector''s SignalFlow program that publishes the results of the detect(). The object is created by a publish(