openapi: 3.0.3 info: title: Splunk Observability Cloud — Integrations version: 5.0.1 description: 'API for creating, retrieving, updating, and deleting integrations, which define the connection between an external system and Splunk Observability Cloud. Requirements You must have an organization access token with the API permission or a session token to use the API. You have to have the Splunk Observability Cloud admin role to use the POST /integration, GET /integration, GET /integration/{id}, PUT /integration/{id}, DELETE /integration/{id}, and GET /integration/validate/{id} operations.' x-provenance: method: reconstructed authored_by: Splunk (content) / API Evangelist (assembly) reconstructed_by: API Evangelist reconstructed_on: '2026-08-19' first_party: false provider_published: false note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's. Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset path, including invented control paths — so this is NOT first-party publication and is not graded as such. x-evidence: - type: source url: https://dev.splunk.com/observability/reference/ - type: source url: https://dev.splunk.com/observability/docs/apibasics/api_list/ servers: - url: https://api.{REALM}.observability.splunkcloud.com/v2 description: Integrations API endpoint URL variables: REALM: default: us0 description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0). security: - SessionToken: [] components: securitySchemes: SessionToken: type: apiKey in: header name: X-SF-Token description: Splunk Observability Cloud session token or org access token. paths: /integration: get: summary: Retrieve Integrations Query description: 'Retrieves one or more integration objects based on a query specified in query parameters encoded on the URL. Notes: To ensure security, the API omits some authentication and authorization properties from response objects. Note: Splunk Observability Cloud returns a maximum of 10,000 objects, even if your organization contains more than 10,000. To learn more, see the Considerations for retrieve operations section in the Developer Guide for Splunk Observability Cloud. Jira integration: The response body for a Jira integration contains a union of the following response properties: Properties common to all integration responses Properties common to all Jira integration responses Authentication credential properties for Jira Cloud integrations Authentication credential properties for Jira Server integrations Some Jira integration properties are set to null in the response: Optional properties that you didn''t specify in your creation request Password or API token, to ensure security Properties not used for a specific type of Jira integration. For example, if you integrate with Jira Cloud, the response body contains "username"\: null because username isn''t a valid property for a Jira Cloud integration.' parameters: - name: name in: query description: 'Integration object name to search for. You can use wildcard characters to specify the name: *: Matches a run of any characters in any part of the name ?: Matches any single character in any part of the name' schema: type: string - name: type in: query description: 'Type of integration to search for. This property is an enumerated string, and only the enumerated values are allowed. To search for a Microsoft Teams integration, use Office365.' schema: type: string enum: - ADFS - AWSCloudWatch - AmazonEventBridge - Azure - AzureAD - BigPanda - GCP - GoogleSaml - Jira - Office365 - Okta - OneLogin - Opsgenie - PagerDuty - PingOne - ServiceNow - Slack - VictorOps - Webhook - XMatters - name: offset in: query description: '0-relative position in the result set where the API should start returning integration objects.' schema: type: integer format: int32 default: 0 minimum: 0 - name: limit in: query description: Number of integration objects to return from the result set schema: type: integer format: int32 default: 50 minimum: 1 - name: userParam in: query description: 'Return user name values in the response based on the full name value from the user''s profile. To return the name of the user who created the integration, specify userParam=creator. The system responds by populating the createdByName field with the name of the user who created the integration, instead of the default value of null. To return the name of the user who last updated the integration, specify userParam=lastUpdatedBy. The system responds by populating the lastUpdatedByName field with the name of the user who last updated the integration, instead of the default value of null. You can specify one or both parameter values. For example, to include both parameters, specify userParam=creator&userParam=lastUpdatedBy. This property is an enumerated string, and only the enumerated values are allowed.' schema: type: string enum: - creator - lastUpdatedBy - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: type: object properties: count: type: integer format: int64 description: 'Number of integrations that matched the search criteria. This value is not the number of integrations returned in the response body. To learn more, see the description of results.' results: type: array items: oneOf: - title: Microsoft ADFS Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - ADFS example: ADFS description: 'Type of service that this integration represents, in the form of an enumerated string, always "ADFS".' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration required: - type type: object description: 'Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.' - title: AWS CloudWatch Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' type: type: string enum: - AWSCloudWatch example: AWSCloudWatch description: 'Type of service that this integration represents, in the form of an enumerated string, always "AWSCloudWatch".' authMethod: title: AWS CloudWatch Integration Authentication Method type: string readOnly: false enum: - ExternalId - SecurityToken example: ExternalId description: 'Indicates the mechanism used to authenticate with AWS. The allowed values are: "ExternalId": Expects you to supply an external ID and ARN for AWS "SecurityToken": Expects you to supply a key and token Note: For the GovCloud and China AWS regions, you can only use "AuthMethod": "SecurityToken"' collectOnlyRecommendedStats: title: AWS CloudWatch Integration Collect Only Recommended Stats Flag type: boolean default: false description: 'If set to true, Splunk Observability Cloud collects only a subset of statistics for metrics specified in the list of AWS recommended stats. If a metric is not on the recommended stats list, the integration collects the 5 default statistics: SampleCount (count in Splunk Observability Cloud), Average (mean), Sum (sum), Minimum (lower), and Maximum (upper).' customCloudWatchNamespaces: title: AWS CloudWatch Custom Namespace List type: string description: 'Comma-separated string list that contains custom AWS CloudWatch namespaces to monitor. These can be either custom namespaces you''ve created in AWS, or any namespace defined by AWS that Splunk Observability Cloud doesn''t support by default. To see the list of AWS services that Splunk Observability Cloud supports by default, see Supported AWS services in the Splunk Observability Cloud user documentation. Custom namespaces provide additional metrics. customCloudWatchNamespaces and customNamespaceSyncRules are similar but not equivalent: customCloudWatchNamespaces is list of namespaces, and customNamespaceSyncRules is an array of objects that specify a namespace and data collection rules for that namespace. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, the system ignores the value of customCloudWatchNamespaces. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' customNamespaceSyncRules: title: AWS CloudWatch Custom Namespace Sync Rule List type: array items: title: AWS CloudWatch Custom Namespace Sync Rule type: object properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: title: AWS CloudWatch Custom Namespace type: string description: 'Name of an AWS CloudWatch namespace you created to contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the AWS documentation for publishing metrics.' description: 'Specifies AWS namespaces you created, and the filters that Splunk Observability Cloud applies to data coming from from those namespaces.' description: 'List of custom AWS namespaces and filters, in the form of a JSON array of JSON objects. Each object specifies data collection rules for a single AWS namespace. Custom namespaces are namespaces you created. They contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the Amazon AWS documentation for publishing metrics. customNamespaceSyncRules and customCloudWatchNamespaces are similar but not equivalent: customNamespaceSyncRules is a list of objects that specify a namespace and data collection rules for that namespace, and customCloudWatchNamespaces is a list of namespaces. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, Splunk Observability Cloud ignores the customCloudWatchNamespaces property. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' enableAwsUsage: type: boolean example: true title: EnableAwsUsage description: 'Controls how Splunk Observability Cloud imports usage metrics from AWS to use with AWS Optimizer. If true, Splunk Observability Cloud imports the metrics.' enableCheckLargeVolume: title: AWS CloudWatch Large Data Volume Flag type: boolean example: true description: Controls how Splunk Observability Cloud checks for large amounts of data for this AWS integration. This check only runs once. If true, Splunk Observability Cloud monitors the amount of data coming in from the integration. If over 100,000 metrics are fetched, the integration is disabled. You can re-enable the integration afterwards. externalId: title: AWS CloudWatch Integration External ID type: string readOnly: true example: abcdefghijklmnopqrst description: 'If you specify "authMethod": "ExternalId" in your request to create an AWS integration object, the response object contains a value for externalId. Use this value and the ARN value you get from AWS to update the integration object. Splunk Observability Cloud can then connect to AWS using the integration object. Note: Splunk Observability Cloud sets this value, and you can''t change it.' ignoreAllStatusMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: 'true by default. When set to true, the following metrics are ignored: StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System. When set to false, only StatusCheckFailed is ignored.' importCloudWatch: title: Amazon CloudWatch Integration Metrics Import Flag type: boolean example: true description: 'Controls how Splunk Observability Cloud imports AWS CloudWatch metrics. If true, Splunk Observability Cloud imports Cloud Watch metrics from AWS.' includeEMRInstancesMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: false by default. If true, it syncs Elastic Map Reduce EC2 instance metrics. EC2 EMR instances are identified by the aws:elasticmapreduce:job-flow-id tag put on an instance. isLargeVolume: title: AWS CloudWatch Integration Receiving Large Volume Flag type: boolean example: false description: If true, it indicates that Splunk Observability Cloud is receiving over 100,000 metrics and tags from AWS. This property is read-only, and is only available if enableCheckLargeVolume is true. key: type: string format: password title: AWSKey description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the key.' metadataPollRate: title: Amazon CloudWatch Integration metadata poll rate type: integer format: int64 example: 900000 description: Specifies how often AWS metadata (tags and properties) are synchronized for the supported AWS services, in milliseconds. The default value is 15 minutes (900,000 ms), and can range from 1 minute to 1 hour. metricStatsToSync: title: Controls statistics per metric per namespace type: object additionalProperties: true example: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 description: 'A collection (associative array) of statistics to ingest for AWS metrics for AWS namespaces: Each primary key-value pair in the map specifies an AWS namespace name and a collection of metrics. Each key-value pair in the metrics collection specifies a metric name and an array of statistics. Considerations: The AWS namespace name can be up to 255 characters. It can''t start with a colon character (":"). The AWS metric name can be up to 255 characters. You can specify up to 10 statistics per metric. The API ignores blank, empty, or null statistics names. The API always returns the Splunk Observability Cloud form of a statistic name, regardless of its name in AWS. The statistics you can retrieve also depend on your use of AWS metric streams. For more information, see the Specify AWS statistics section in the Developer Guide for Splunk Observability Cloud.' metricStreamsSyncState: title: AWS CloudWatch Integration Metrics Streams Sync State type: string enum: - DISABLED - ENABLED - CANCELLING - CANCELLATION_FAILED example: ENABLED description: 'If set to ENABLED, enables AWS integration synchronization of Amazon CloudWatch Metrics Streams with Splunk Observability Cloud. The state indicator has four possible values: "DISABLED": Default. Only Splunk Observability Cloud can set the indicator to this value. Synchronization is disabled. "ENABLED"" Set this value to turn on synchronization. "CANCELLING": Set this value to turn off synchronization. This value triggers the cleanup procedure in your AWS account. The procedure deletes the AWS CloudWatch Metrics Streams objects in your account. Note: Change the state indicator to CANCELLING before you make any changes to the AWS policy that Splunk Observability Cloud uses. Splunk Observability Cloud still needs permissions set in the AWS policy in order to run the cleanup procedure. "CANCELLATION_FAILED": Returned by the API in the response body when the cleanup procedure failed. To retry the cancellation, change the value to "CANCELLING" and resend the request. The most common reason for a failed cancellation is a lack of required permissions. For example, if you first remove IAM permissions in AWS, you no longer have permission to run the cleanup procedure. Only Splunk Observability Cloud can set the indicator to this value. Note: CloudWatch Metric Streams doesn''t support filtering based on resource tags.' metricStreamsManagedExternally: type: boolean default: false example: true title: AWSMetricStreamsManagedExternally description: If set to true, Splunk Observability Cloud accepts data from Metric Streams managed from the AWS console. The AWS account sending the Metric Streams and the AWS account in the Splunk Observability Cloud integration have to match. namespacesExcludeTagSync: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' example: - AWS/ElasticBeanstalk - AWS/ElastiCache title: AWSNamespacesExcludeTagSync description: 'List of namespace names, defined by AWS, to exclude from tag metadata syncing. This property is similar to nameSpaceSyncRules, but namespacesExcludeTagSync excludes metadata rather than metrics for specific namespaces.' namespaceSyncRules: type: array minItems: 0 items: type: object required: - namespace properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNameSpaceSyncRule description: 'Namespace sync rule for a namespace defined by AWS. The rule contains the AWS namespace name and filter criteria. Splunk Observability Cloud applies the criteria to data coming in from the namespace.' title: AWSNameSpaceSyncRules description: 'List of AWS namespace sync rules. Each object contains a namespace name defined by AWS CloudWatch and filter criteria that Splunk Observability Cloud applies to data coming in from that namespace. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' prePauseState: type: string example: metricStreamsSyncState: ENABLED title: AWSPrePauseState description: Stores the integration's Metric Streams states previous to a change forced by modifying enabled. pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' inactiveMetricsPollRate: title: AWS CloudWatch Inactive Metrics Poll Rate type: integer format: int64 minimum: 60000 maximum: 3600000 example: 300000 description: 'Polling interval for AWS CloudWatch metrics that are not recently used. Splunk Observability Cloud applies this rate to metrics that have not been accessed by charts, detectors, or API queries within the recent usage window. The minimum value is 60000 ms (1 minute) and the maximum is 3600000 ms (60 minutes).' regions: type: array items: type: string enum: - ap-east-1 - ap-northeast-1 - ap-northeast-2 - ap-south-1 - ap-southeast-1 - ap-southeast-2 - ca-central-1 - eu-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - sa-east-1 - us-east-1 - us-east-2 - us-west-1 - us-west-2 example: - us-east-1 - us-east-2 - us-west-1 - us-west-2 title: AWSRegions description: 'List of AWS regions that you want Splunk Observability Cloud to monitor, in the form of a JSON array. See the list of AWS regions supported by Splunk Observability Cloud. If you omit the regions field or use "regions": [], the API adds all regular AWS regions to your integration. If you add the ec2:DescribeRegions permission to your AWS account, optional regions you''ve enabled on your AWS account will be enabled in Splunk Observability Cloud as well. If you want to enable a specific optional region, you need to do it before adding it to the integration. You can''t mix regions from different sets. For example, you can''t specify "regions": [ "eu-west-1", "cn-north-1"].' roleArn: type: string example: arn:aws:iam::123456789012:role/myIntegration title: AWSRoleArn description: 'Role ARN that you add to an existing AWS integration object. When you create an AWS integration object and specify "ExternalId" as the authentication method, Splunk Observability Cloud responds with an external ID. You provide this ID to AWS, which responds with a role ARN. To finish the connection between Splunk Observability Cloud and AWS, update the AWS integration object using a PUT request. In the request, specify roleArn property using the value you obtained from AWS. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNamespaceArray description: 'List of services, defined by AWS, for which you want Splunk Observability Cloud to collect data. This list refers to services by their AWS namespace names. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' sfxAwsAccountArn: title: Splunk Observability Cloud's AWS account ID description: Read-only. Specifies Splunk Observability Cloud's AWS account ID. It's used to establish a trust relationship with IAM when setting up IAM role used by the AWS integration. token: type: string format: password title: AWSToken description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the token.' syncCustomNamespacesOnly: type: boolean default: false example: true title: AWSSyncCustomNamespacesOnly description: Flag that controls the synchronization of metrics from custom AWS namespaces only. The default is false. If set to true, Splunk Observability Cloud only syncs metrics from custom AWS namespaces, and disregards metrics from built-in services. This is useful to limit data ingestion. syncLoadBalancerTargetGroupTags: type: boolean default: false example: true title: AWSSyncLoadBalancerTargetGroupTags description: 'This parameter is deprecated. Flag that controls the synchronization of Load Balancer Target group tags. If true, Splunk Observability Cloud syncs tags. The default is false. Note: To synchronize Load Balancer Target group tags, your AWS policy must include the permission elasticloadbalancing:DescribeTargetGroups. To learn more, see the Connect to AWS and send data to Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' required: - type - authMethod type: object description: 'Specifies the data collection integration between AWS CloudWatch and Splunk Observability Cloud, in the form of a JSON object.' - title: Amazon EventBridge Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' awsAccountId: title: Amazon EventBridge Integration Account ID type: string example: 123456789012 description: 'ID of the AWS account to use for the Amazon EventBridge integration. You get this value from AWS and send it to Splunk Observability Cloud when you create the integration.' eventSource: title: Amazon EventBridge Integration Event Source type: string example: aws.partner/buttercup.com/abcdefghijklmnopqrst description: 'String that identifies the Splunk Observability Cloud integration to Amazon EventBridge. Splunk Observability Cloud returns this string when you create the integration. The string has the format "/": "": Identifies Splunk Observability Cloud as the partner. Always aws.partner/observability.splunkcloud.com "": Splunk Observability Cloud event source identifier.' awsRegion: title: Amazon EventBridge Integration Region type: string example: ap-south-1 description: 'AWS region associated with the Amazon EventBridge integration. Each region that sends notifications needs its own integration. See the list of AWS regions supported by Splunk Observability Cloud.' type: type: string enum: - AmazonEventBridge example: AmazonEventBridge description: 'Type of service that this integration represents, in the form of an enumerated string, always "AmazonEventBridge".' required: - type type: object description: 'Specifies the properties of the integration between Amazon EventBridge and Splunk Observability Cloud, in the form of a JSON object' - title: Microsoft Azure Active Directory Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - AzureAD example: AzureAD description: 'Type of service that this integration represents, in the form of an enumerated string, always "AzureAD".' required: - type type: object description: 'Specifies the SAML integration between Azure Active Directory and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Azure Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' additionalServices: type: array items: type: string description: Name of a resource type to sync with Splunk Observability Cloud example: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices title: AzureAdditionalServices description: 'Additional Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. If you want to sync Azure resource types that Splunk Observability Cloud doesn''t fully support, add the types to the additionalServices array. The documentation for the services field contains a list of fully supported types. A resource type you specify in additionalServices must meet the following criteria: The type is a Azure GenericResource. For resource types that have hierarchical structure, only the root resource type is a GenericResource. For example, a Storage Account type can have a File Service type, and a File Service type can have a File Storage type. In this case, only Storage Account is a GenericResource. The resource type stores its metrics in Azure Monitor. To learn more about Azure Monitor, refer to the Microsoft Azure documentation. Splunk Observability Cloud syncs resource types that you specify in either services or additionalServices. If you add a resource type to both fields, Splunk Observability Cloud ignores the duplication.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' appId: type: string format: password title: AzureAppId description: 'Azure application ID for Splunk Observability Cloud. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' azureEnvironment: type: string enum: - AZURE - AZURE_US_GOVERNMENT example: AZURE title: AzureEnvironment description: 'Enumerated string that tells Splunk Observability Cloud what type of Azure integration this is. The allowed values are "AZURE_US_GOVERNMENT" and "AZURE". If you don''t specify a value in a POST request, Splunk Observability Cloud defaults to "AZURE".' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' secretKey: type: string format: password title: AzureSecretKey description: 'Azure secret key that associates Splunk Observability Cloud in Azure with the Azure tenant ID. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - microsoft.analysisservices/servers - microsoft.apimanagement/service - microsoft.automation/automationaccounts - microsoft.batch/batchaccounts - microsoft.cache/redis - microsoft.classiccompute/virtualmachines - microsoft.cognitiveservices/accounts - microsoft.compute/virtualmachines - microsoft.compute/virtualmachinescalesets - microsoft.compute/virtualmachinescalesets/virtualmachines - microsoft.containerinstance/containergroups - microsoft.containerservice/managedclusters - microsoft.customerinsights/hubs - microsoft.datafactory - microsoft.datafactory/datafactories - microsoft.datafactory/factories - microsoft.datalakeanalytics/accounts - microsoft.datalakestore/accounts - microsoft.dbformysql/servers - microsoft.dbforpostgresql/servers - microsoft.devices/elasticpools - microsoft.devices/elasticpools/iothubtenants - microsoft.devices/iothubs - microsoft.devices/provisioningservices - microsoft.documentdb/databaseaccounts - microsoft.eventhub/namespaces - microsoft.hdinsight/clusters - microsoft.keyvault/vaults - microsoft.locationbasedservices/accounts - microsoft.network/applicationgateways - microsoft.network/dnszones - microsoft.network/expressroutecircuits - microsoft.network/loadbalancers - microsoft.network/publicipaddresses - microsoft.network/trafficmanagerprofiles - microsoft.network/virtualnetworkgateways - microsoft.notificationhubs/namespaces/notificationhubs - microsoft.powerbidedicated/capacities - microsoft.relay/namespaces - microsoft.search/searchservices - microsoft.servicebus/namespaces - microsoft.sql/servers - microsoft.sql/servers/databases - microsoft.sql/servers/elasticpools - microsoft.storage/storageaccounts - microsoft.storage/storageaccounts/blobservices - microsoft.storage/storageaccounts/fileservices - microsoft.storage/storageaccounts/queueservices - microsoft.storage/storageaccounts/tableservices - microsoft.streamanalytics/streamingjobs - microsoft.web - microsoft.web/hostingenvironments/multirolepools - microsoft.web/hostingenvironments/workerpools - microsoft.web/serverfarms - microsoft.web/sites/slots example: - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs title: AzureServices description: 'List of Microsoft Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. Each element of services must be a resource type that Splunk Observability Cloud fully supports. The specification for array elements in services includes an enumerated list of fully supported types. To see the enumerated list of services, click the arrowhead to expand services, then click the arrowhead to expand ENUM. If you try to add a resource type that''s not in the enumerated list, Splunk Observability Cloud returns a 4xx HTTP response code. Even if the resource type isn''t listed, Splunk Observability Cloud might provide basic support for it. To learn more, see the documentation for the additionalServices field.' subscriptions: type: array items: type: string title: AzureSubscriptions description: 'List of Azure subscriptions that Splunk Observability Cloud should monitor, in the form of a JSON array of strings' resourceFilterRules: type: array items: type: object properties: filter: type: object properties: source: type: string example: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) description: Resource filter title: AzureResourceFilterRules description: 'List of rules to filter Azure resources by their tags. The source of each filter rule must be in the form filter(''key'', ''value''). You can join multiple filter statements using the and and or operators. Referenced keys are limited to tags and must be one of the following: tags prefixed with azure_tag_, or azure_resource_name, azure_resource_group_name or azure_kind.' tenantId: type: string example: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx title: AzureTenantId description: 'Azure ID of the Azure tenant. To learn how to get this ID, see the topic Prepare for Azure integration topic in the Splunk Observability Cloud user documentation.' useBatchApi: type: boolean title: AzureUseBatchApi description: false by default. If false, Splunk Observability Cloud uses the Azure Resource Manager Metrics List API to retrieve metrics. If useBatchApi is set to true, the Azure integration polls data using the Metrics Batch API (also known as the getBatch API or Data Plane API). Use this option to reduce observed throttling and latency. Note that Azure bills for requests to the Metrics Batch API. Refer to Azure documentation for more details. importAzureMonitor: type: boolean title: AzureImportAzureMonitor description: true by default. Controls how Splunk Observability Cloud imports Azure metrics. If set to false, metric sync is disabled, and only metadata is synced. type: type: string enum: - Azure example: Azure description: 'Type of service that this integration represents, in the form of an enumerated string, always "Azure".' syncGuestOsNamespaces: type: boolean example: true title: SyncGuestOsNamespaces description: 'Controls whether Splunk Observability Cloud syncs guest operating system (OS) namespaces. The default of false prevents Splunk Observability Cloud from retrieving metrics from guest OS namespace. Setting the field to true causes Splunk Observability Cloud to add metrics from the namespaces that the Azure Diagnostics extension recommends. These namespaces are are telegraf/mem, telegraf/cpu, and azure.vm.windows.guest. You can set syncGuestOsNamespaces to trueand specifycustomNamespacesPerService` at the same time.' customNamespacesPerService: type: object additionalProperties: type: string example: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace title: CustomNamespacesPerService description: 'Service-to-namespaces map that supports custom metrics for more fine-grained control of syncing. Default is empty. If you specify a map, Splunk Observability Cloud syncs metrics from namespaces in the map in addition to the default namespaces. The keys in customNamespacesPerService must be valid resource types. You can set syncGuestOsNamespaces to true and specify customNamespacesPerService at the same time.' required: - type type: object description: 'Specifies the data collection integration between Microsoft Azure and Splunk Observability Cloud, in the form of a JSON object.' - title: BigPanda Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' appKey: type: string format: password description: 'Application key you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' token: type: string format: password description: 'Token you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - BigPanda example: BigPanda description: 'Type of service that this integration represents, in the form of an enumerated string, always "BigPanda".' required: - type type: object description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Google Cloud Platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' customMetricTypeDomains: title: Custom GCP metrics list type: array example: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos items: type: string description: A single GCP service domain name you want to monitor. description: 'List of GCP service domain names that you want to monitor. Splunk Observability Cloud retrieves metrics from these service domains as well as the services you specify in the services field. If you specify an invalid service domain name, the system responds with an HTTP response code 400 and an error message. To learn more about the customMetricTypeDomains field, see the Custom metric type domains section in the Developer Guide for Splunk Observability Cloud.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' services: type: array items: type: string enum: - appengine - bigquery - bigtable - cloudfunctions - cloudiot - cloudsql - cloudtasks - compute - container - dataflow - datastore - firebasedatabase - firebasehosting - interconnect - loadbalancing - logging - ml - monitoring - pubsub - router - serviceruntime - spanner - storage - vpn example: - appengine - bigquery - bigtable title: GCPServices description: 'Array of GCP services that you want Splunk Observability Cloud to monitor. Splunk Observability Cloud only supports certain services, and if you specify an unsupported one, you receive an API error. The supported services are: "appengine" "bigquery" "bigtable" "cloudfunctions" "cloudiot" "cloudsql" "cloudtasks" "compute" "container" "dataflow" "datastore" "firebasedatabase" "firebasehosting" "interconnect" "loadbalancing" "logging" "ml" "monitoring" "pubsub" "router" "serviceruntime" "spanner" "storage" "vpn" To learn more, see the Connect to GCP topic in the Splunk Observability Cloud user documentation.' projects: title: GCPProjects type: object required: - selectedProjectIds properties: selectedProjectIds: type: array items: type: string example: - xxxxxx-yyyyyy-123456 description: A list of selected project ids. Use this only if syncMode is SELECTED. Only those projects will be synchronized. syncMode: type: string example: ALL_REACHABLE description: Valid values are ALL_REACHABLE or SELECTED. Mode of projects discovery ALL_REACHABLE - automatic synchronization of reachable projects. SELECTED - requires specifying a list of projects in selectedProjectIds. Only those projects will be synchronized. description: Project synchronization configuration. Allows you to choose synchronization mode - automatic synchronization or explicit list of projects. projectServiceKeys: type: array items: type: object required: - projectId - projectKey properties: projectId: type: string example: xxxxxx-yyyyyy-123456 description: GCP project ID you specified when you created your GCP project projectKey: type: string description: 'Contents of the GCP service account key file you generated when you created the project. Ensure that you escape special characters in this value before you you send it to Splunk Observability Cloud. Note: To ensure security, the API doesn''t return the value of this property in a response object.' title: GCPProjectServiceKey description: 'Properties of a GCP project, in the form of a JSON object. Contains the GCP project ID and GCP service account key for a GCP project that you want Splunk Observability Cloud to monitor.' title: GCPProjectServiceKeys description: 'List of GCP projects that you want Splunk Observability Cloud to monitor, in the form of a JSON array of objects' type: type: string enum: - GCP example: GCP description: 'Type of service that this integration represents, in the form of an enumerated string, always "GCP".' whitelist: deprecated: true description: DEPRECATED. Use includeList. includeList: type: array items: type: string minItems: 0 description: GCP metadata name example: - zone - labels - testkey1 - mywhitelist title: GCPIncludeList description: 'List of custom metadata keys that you want Splunk Observability Cloud to collect for GCP Compute Engine instances, in the form of a JSON array.' importGCPMetrics: type: boolean title: GCPImportGCPMetrics description: true by default. Controls how Splunk Observability Cloud imports GCP metrics. If set to false, metric sync is disabled, and only metadata is synced. useMetricSourceProjectForQuota: type: boolean items: type: boolean title: GCPUseMetricSourceProjectForQuota description: Set to true to use a quota from the project where metrics are stored. To use this, the project's service account requires a serviceusage.services.use permission, or you need a Service Usage Consumer role in the project. workloadIdentityFederationConfig: type: string title: GCPWorkloadIdentityFederationConfig description: Workload Identity Federation configuration exported from your account. Instructs Splunk Observability on how to authenticate to your GCP account. workloadIdentityFederationConfigs: deprecated: true type: array items: type: object title: GCPWorkloadIdentityFederationConfigs description: Pairs of projectId and wifConfig, where wifConfig is a Workload Identity Federation configuration. Deprecated. Use workloadIdentityFederationConfig and projects field instead. authMethod: type: string example: WORKLOAD_IDENTITY_FEDERATION title: GCPAuthMethod description: Authentication method. Valid values are WORKLOAD_IDENTITY_FEDERATION or SERVICE_ACCOUNT_KEY. If null it defaults to SERVICE_ACCOUNT_KEY wifSplunkIdentity: type: string readOnly: true example: service_account: splunk-observability@.iam.gserviceaccount.com title: GCPWifSplunkIdentity description: Splunk identity to use in Workload Identity Federation (WIF) attribute conditions and policy bindings excludeGCEInstancesWithLabels: title: GCP Compute Engine instance label exclusion list type: array items: type: string example: - goog-dataproc-cluster-uuid - custom-label description: 'List of label keys. GCP Compute Engine instances with any of these labels applied will be excluded from metric sync. To use this feature, the project''s service account requires a compute.instances.list permission. Note: You shall specify GCP labels as they appear in GCP without the gcp_label_ prefix.' required: - type type: object description: 'Specifies the data collection integration between Google Cloud Platform and Splunk Observability Cloud, in the form of a JSON object.' - title: Google Cloud Identity Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration type: type: string enum: - GoogleSaml example: GoogleSaml description: 'Type of service that this integration represents, in the form of an enumerated string, always "GoogleSaml".' required: - type type: object description: 'Specifies the SAML integration between Google Cloud Identity Integration Model and Splunk Observability Cloud, in the form of a JSON object.' - title: Jira Integration Response example: created: 1556728926015 creator: X_xxxxXXXXX enabled: true id: XXxxxXXXXXX name: Jira Cloud integration for warning notifications type: Jira assignee: name: mtwain displayName: Mark Twain authMethod: EmailAndToken baseUrl: https://www.buttercup.com issueType: Story projectKey: GEN userEmail: mtwain@example.com lastUpdated: 1557513720143 lastUpdatedBy: X_xxxx5XXXX username: null password: null apiToken: null properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' assignee: title: Jira ticket assignee type: object required: - name properties: name: title: Assignee user name type: string example: juser description: Jira user name for the assignee displayName: title: Assignee display name example: Jira User description: Jira display name for the assignee description: 'Username and optionally display name of the user to whom Jira assigns a new ticket for detector notifications. If you don''t specify this property when you create or update the integration, Splunk Observability Cloud uses the value of assignee from the detector that creates the alert notification. This lets you set a default assignee that individual detectors can override. If you don''t specify assignee for the integration or the detector, Jira uses its default value.' authMethod: title: Jira Integration Authentication Method type: string enum: - EmailAndToken - UsernameAndPassword example: EmailAndToken description: 'Authentication method to use when creating the Jira integration. The value must match the type of Jira instance you''re integrating with: Jira Cloud instance: "EmailAndToken" Jira Server instance: "UsernameAndPassword"' baseUrl: title: Jira Instance Base URL type: string format: url example: https://myjirainstance.atlassian.net description: 'Base URL of the Jira instance that''s integrated with Splunk Observability Cloud. The URL is supplied by Jira.' issueType: title: Jira issue type type: string example: Bug description: 'Issue type (for example, Story) for tickets that Jira creates for detector notifications Splunk Observability Cloud validates issue types, so you must specify a type that''s valid for the Jira project specified in projectKey.' projectKey: title: Jira Project Key type: string example: PRJ description: 'Jira key of an existing project. When Jira creates a new ticket for a detector notification, the ticket is assigned to this project.' type: type: string enum: - Jira example: Jira description: 'Type of service that this integration represents, in the form of an enumerated string, always "Jira".' apiToken: title: API token for Jira Cloud user email type: string example: x9X9XXXXxXXxxxxXxXxX9999 description: 'API token for the user email you use in authentication credentials for a Jira Cloud integration.' userEmail: title: Jira Cloud User Email type: string format: email example: user@mydomain.atlassian.net description: 'Email address used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' password: title: Jira Server User Password type: string format: password example: mypassword description: 'Password for the username used in Jira Server authentication credentials.' username: title: Jira Server User Name type: string example: myusername description: 'Username used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' required: - type type: object description: 'Properties returned from Splunk Observability Cloud when you create, retrieve or update an integration between Jira and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Teams Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' webhookUrl: title: Microsoft Teams Integration webhook URL type: string format: uri example: https://.webhook.office.com/webhook2/xxxxxxx description: 'Webhook URL provided by Microsoft Teams. When you create or update the integration, you must provide a Microsoft Teams URL known to Microsoft; otherwise, Microsoft rejects the request. To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - Office365 description: 'Type of service that this integration represents, in the form of an enumerated string. To ensure backward compatibility with previous versions of this integration, the type is "Office365".' required: - type type: object description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object.' - title: Okta Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - Okta example: Okta description: 'Type of service that this integration represents, in the form of an enumerated string, always "Okta".' required: - type type: object description: 'Specifies the SAML integration between Okta and Splunk Observability Cloud, in the form of a JSON object.' - title: OneLogin Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - OneLogin example: OneLogin description: 'Type of service that this integration represents, in the form of an enumerated string, always "OneLogin".' required: - type type: object description: 'Specifies the SAML integration between OneLogin and Splunk Observability Cloud, in the form of a JSON object.' - title: Opsgenie Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'An Opsgenie API key for sending alerts to an Opsgenie team or teams. Note: To ensure security, the API doesn''t return this property in response objects.' apiUrl: type: string format: url example: https://api.buttercup.com/ description: Your Opsgenie API URL type: type: string enum: - Opsgenie example: Opsgenie description: 'Type of service that this integration represents, in the form of an enumerated string, always "Opsgenie".' required: - apiKey - apiUrl - type type: object description: 'Specifies the properties of a notification service integration between Opsgenie and Splunk Observability Cloud, in the form of a JSON object' - title: PagerDuty Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'A key you get from PagerDuty that lets you integrate Splunk Observability Cloud with PagerDuty. PagerDuty refers to this property as the integrationKey. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - PagerDuty example: PagerDuty description: 'Type of service that this integration represents, in the form of an enumerated string, always "PagerDuty".' required: - type type: object description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object.' - title: PingOne Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' type: type: string enum: - PingOne example: PingOne description: 'Type of service that this integration represents, in the form of an enumerated string, always "PingOne".' required: - type type: object description: 'Specifies the SAML integration between PingOne and Splunk Observability Cloud, in the form of a JSON object.' - title: ServiceNow Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' instanceName: type: string example: anInstance.service-now.com description: 'ServiceNow instance name, for example myInstances.service-now.com. To learn more, see the Send alert notifications to ServiceNow using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' issueType: type: string enum: - Event - Incident - ImportSet - Problem example: Problem description: 'Type of issue, using standard ITIL terminology. This is an enumerated string that has the following possible values: Event Incident ImportSet Problem' username: type: string example: username description: 'Username you created in ServiceNow for the Splunk Observability Cloud integration. Note: In ServiceNow, you have to assign the roles web_service_admin and itil to this username.' password: type: string format: password description: 'Password associated with the username you created for this integration.' tableName: type: string example: u_incident_import description: Only applicable to integration instances with issueType of ImportSet value. Name of the custom table you created in ServiceNow. Splunk Observability Cloud sends requests to the specified table. type: type: string enum: - ServiceNow example: ServiceNow description: 'Type of service that this integration represents, in the form of an enumerated string, always "ServiceNow".' alertTriggeredPayloadTemplate: type: string example: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertResolvedPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow POST JSON payloads when an alert sends a notification to ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' alertResolvedPayloadTemplate: type: string example: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertTriggeredPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow PUT JSON payloads when an alert is cleared in ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' required: - type type: object description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - Webhook - OAuth example: OAuth description: 'Indicates the authentication method you want to use for integrating with the Slack API. This enumerated string has the following allowed values: Webhook OAuth' webhookUrl: type: string description: 'If you set "method": "Webhook", set "webhookUrl" to specify the incoming webhook URL. Note: To ensure security, the API doesn''t return this property in response objects.' scope: type: string description: 'If you set "method": "OAuth", set "scope" to specify the Slack OAuth scope string associated with this integration.' slackTeamName: type: string description: 'If you set "method": "OAuth", use "slackTeamName" to specify the name of the Slack team you''ve approved for this integration.' slackTeamId: type: string description: 'If you set the "method" property to "OAuth", use "slackTeamId" to specify the Slack ID for the Slack team you''ve approved for this integration.' slackUserId: type: string description: 'If you set the "method" property to "OAuth", use "slackUserId" to specify the Slack ID for the Slack user that approved this integration.' accessTokenUpdated: type: integer format: int64 example: 1555929030000 description: 'If you set the "method" property to "OAuth", "accessTokenUpdated" contains the last time that Slack refreshed or updated the access token. The value is in Unix time.' type: type: string enum: - Slack example: Slack description: 'Type of service that this integration represents, in the form of an enumerated string, always "Slack".' required: - type type: object description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk On-Call Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' postUrl: type: string description: 'Splunk On-Call API integration URL. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - VictorOps example: VictorOps description: 'Type of service that this integration represents, in the form of an enumerated string, always "VictorOps".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - SplunkPlatform example: SplunkPlatform description: 'Type of service that this integration represents, in the form of an enumerated string, always "SplunkPlatform"' url: type: string format: uri example: https://http-inputs-.splunkcloud.com description: Specify the HTTP Event Collector (HEC) URI for your Splunk platform instance. To learn more about HEC in Splunk platform, see the Send data to HTTP Event Collector section in the Documentation for Splunk Cloud Platform. hecToken: type: string example: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 description: 'HTTP Event Collector token that allows access to your Splunk platform instance. Splunk Observability Cloud doesn''t support HEC indexer acknowledgement. To use the Splunk platform integration, don''t activate indexer acknowledgement for HEC token in your Splunk Enterprise instance. Note: The value of hecToken isn''t returned in the response body.' payloadTemplate: type: string description: 'Customize the Splunk platform alert payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For the full list of supported variables, see the Supported variables for Splunk platform integration custom payload section in the Splunk Observability Cloud user documentation.' required: - type type: object description: Specifies the properties of a notification service integration between Splunk Observability Cloud and Splunk platform, in the form of a JSON object - title: Webhook Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - POST - PUT - GET example: POST default: POST description: HTTP method used to send webhook data. Valid methods include POST, PUT, and GET payloadTemplate: type: string example: severity: '{{{severity}}}' originatingMetric: '{{{originatingMetric}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' messageBody: '{{{encodeString messageBody}}}' src: '{{{src}}}' inputs: '{{{json inputs}}}' rule: '{{{encodeString rule}}}' description: '{{{encodeString description}}}' messageTitle: '{{{encodeString messageTitle}}}' sf_schema: '{{{sf_schema}}}' eventType: '{{{eventType}}}' runbookUrl: '{{{runbookUrl}}}' orgId: '{{{orgId}}}' detectorId: '{{{detectorId}}}' imageUrl: '{{{imageUrl}}}' tip: '{{{encodeString tip}}}' statusExtended: '{{{statusExtended}}}' incidentId: '{{{incidentId}}}' detector: '{{{encodeString detector}}}' detectorUrl: '{{{detectorUrl}}}' status: '{{{status}}}' timestamp: '{{{timestamp}}}' dimensions: '{{{json dimensions}}}' description: 'Customize the webhook payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For more information, see Webhook default payload. For the full list of supported variables, see the Integrate a webhook with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' url: type: string format: uri example: https://example.com/alarm/{{incidentId}}?status={{status}} description: Specify webhook's external site URL. You can use the Handlebars syntax for this URL. sharedSecret: type: string format: password description: 'Value that Splunk Observability Cloud uses as the secret cryptographic key in a message authentication code computation based on the HMAC-SHA256 algorithm. The Shared secret section in the Developer Guide for Splunk Observability Cloud describes the use sharedSecret in more detail. When you use sharedSecret, you need to know the steps Splunk Observability Cloud uses to compute the message authentication code, so you can perform the same computation and compare your results to a value you receive in the webhook request. sharedSecret is not returned in the response body.' headers: type: object example: Content-Type: application/json description: 'Associative array of HTTP headers and values, in the form of a JSON object. Splunk Observability Cloud adds the headers and values to HTTP requests sent to the webhook''s external site. When you provide a value for the payloadTemplate property, the headers property is used to determine expected payload type. When the headers property specifies "Content-Type" as "application/json" or "application/ld+json", Splunk Observability Cloud validates that the payload template produces a valid JSON objects. When no "Content-Type" is specified, Splunk Observability Cloud assumes you want to use a JSON payload and uses that validation.' type: type: string enum: - Webhook example: Webhook description: 'Type of service that this integration represents, in the form of an enumerated string, always "Webhook".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk Observability Cloud and an external site' - title: xMatters Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' url: type: string format: uri example: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' description: 'Webhook URL that connects the integration to your xMatters account. You get this URL from your xMatters account. To learn how, see the "SignalFx" topic in the "Integrations" section of the xMatters website.' type: type: string enum: - XMatters example: XMatters description: 'Type of service that this integration represents, in the form of an enumerated string, always "XMatters".' required: - type type: object description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' description: 'List of integrations, in the form of a JSON array of JSON objects. Each object contains properties that are common to all integrations as well as properties that are specific to the integration type (type property) for the object. The size of results and the value of count are not necessarily equal: If you don''t specify limit or offset: If count > 50, then sizeOf(results) = 50; otherwise sizeOf(results) = count. If you only specify limit: If count > limit then sizeOf(results) = limit; otherwise sizeOf(results) = count. If you specify limit and offset: If count > (offset + limit) then sizeOf(results) = limit; otherwise, sizeOf(results) = limit.' examples: example: value: count: 0 results: - created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: ADFS security: - SessionToken: [] tags: - Integrations post: summary: Create Integration description: 'Creates an integration object that Splunk Observability Cloud uses to connect with a monitoring, SSO, or alerting service. The steps to establish a connection to a service differ for each type of service and might differ for individual services. Each service has specific information requirements for integrating with Splunk Observability Cloud. Notes: To ensure security, the API omits authentication and authorization properties from response objects. In the response object, the enabled property is always set to true. Jira integration: For a Jira integration request, the response body contains a union of the following response properties: Properties common to all integration responses Properties common to all Jira integration responses Authentication credential properties for Jira Cloud integrations Authentication credential properties for Jira Server integrations Some Jira integration properties are set to null in the response: Optional properties that you didn''t specify in your creation request Password or API token, to ensure security Properties not used for a specific type of Jira integration. For example, if you integrate with Jira Cloud, the response body contains "username": null because username isn''t a valid property for a Jira Cloud integration.' parameters: - name: skipValidation in: query description: 'Flag that controls how Splunk Observability Cloud validates an alert integration object. If true, Splunk Observability Cloud doesn''t send a test notification.' schema: type: boolean - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: 'Authentication token. Must be a session token (User API access token) associated with an administrator.' required: true schema: type: string requestBody: required: true content: application/json: schema: oneOf: - title: Microsoft ADFS Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - ADFS example: ADFS description: 'Type of service that this integration represents, in the form of an enumerated string, always "ADFS".' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration required: - type type: object description: 'Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.' - title: AWS CloudWatch Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' type: type: string enum: - AWSCloudWatch example: AWSCloudWatch description: 'Type of service that this integration represents, in the form of an enumerated string, always "AWSCloudWatch".' authMethod: title: AWS CloudWatch Integration Authentication Method type: string readOnly: false enum: - ExternalId - SecurityToken example: ExternalId description: 'Indicates the mechanism used to authenticate with AWS. The allowed values are: "ExternalId": Expects you to supply an external ID and ARN for AWS "SecurityToken": Expects you to supply a key and token Note: For the GovCloud and China AWS regions, you can only use "AuthMethod": "SecurityToken"' collectOnlyRecommendedStats: title: AWS CloudWatch Integration Collect Only Recommended Stats Flag type: boolean default: false description: 'If set to true, Splunk Observability Cloud collects only a subset of statistics for metrics specified in the list of AWS recommended stats. If a metric is not on the recommended stats list, the integration collects the 5 default statistics: SampleCount (count in Splunk Observability Cloud), Average (mean), Sum (sum), Minimum (lower), and Maximum (upper).' customCloudWatchNamespaces: title: AWS CloudWatch Custom Namespace List type: string description: 'Comma-separated string list that contains custom AWS CloudWatch namespaces to monitor. These can be either custom namespaces you''ve created in AWS, or any namespace defined by AWS that Splunk Observability Cloud doesn''t support by default. To see the list of AWS services that Splunk Observability Cloud supports by default, see Supported AWS services in the Splunk Observability Cloud user documentation. Custom namespaces provide additional metrics. customCloudWatchNamespaces and customNamespaceSyncRules are similar but not equivalent: customCloudWatchNamespaces is list of namespaces, and customNamespaceSyncRules is an array of objects that specify a namespace and data collection rules for that namespace. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, the system ignores the value of customCloudWatchNamespaces. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' customNamespaceSyncRules: title: AWS CloudWatch Custom Namespace Sync Rule List type: array items: title: AWS CloudWatch Custom Namespace Sync Rule type: object properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: title: AWS CloudWatch Custom Namespace type: string description: 'Name of an AWS CloudWatch namespace you created to contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the AWS documentation for publishing metrics.' description: 'Specifies AWS namespaces you created, and the filters that Splunk Observability Cloud applies to data coming from from those namespaces.' description: 'List of custom AWS namespaces and filters, in the form of a JSON array of JSON objects. Each object specifies data collection rules for a single AWS namespace. Custom namespaces are namespaces you created. They contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the Amazon AWS documentation for publishing metrics. customNamespaceSyncRules and customCloudWatchNamespaces are similar but not equivalent: customNamespaceSyncRules is a list of objects that specify a namespace and data collection rules for that namespace, and customCloudWatchNamespaces is a list of namespaces. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, Splunk Observability Cloud ignores the customCloudWatchNamespaces property. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' enableAwsUsage: type: boolean example: true title: EnableAwsUsage description: 'Controls how Splunk Observability Cloud imports usage metrics from AWS to use with AWS Optimizer. If true, Splunk Observability Cloud imports the metrics.' enableCheckLargeVolume: title: AWS CloudWatch Large Data Volume Flag type: boolean example: true description: Controls how Splunk Observability Cloud checks for large amounts of data for this AWS integration. This check only runs once. If true, Splunk Observability Cloud monitors the amount of data coming in from the integration. If over 100,000 metrics are fetched, the integration is disabled. You can re-enable the integration afterwards. externalId: title: AWS CloudWatch Integration External ID type: string readOnly: true example: abcdefghijklmnopqrst description: 'If you specify "authMethod": "ExternalId" in your request to create an AWS integration object, the response object contains a value for externalId. Use this value and the ARN value you get from AWS to update the integration object. Splunk Observability Cloud can then connect to AWS using the integration object. Note: Splunk Observability Cloud sets this value, and you can''t change it.' ignoreAllStatusMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: 'true by default. When set to true, the following metrics are ignored: StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System. When set to false, only StatusCheckFailed is ignored.' importCloudWatch: title: Amazon CloudWatch Integration Metrics Import Flag type: boolean example: true description: 'Controls how Splunk Observability Cloud imports AWS CloudWatch metrics. If true, Splunk Observability Cloud imports Cloud Watch metrics from AWS.' includeEMRInstancesMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: false by default. If true, it syncs Elastic Map Reduce EC2 instance metrics. EC2 EMR instances are identified by the aws:elasticmapreduce:job-flow-id tag put on an instance. isLargeVolume: title: AWS CloudWatch Integration Receiving Large Volume Flag type: boolean example: false description: If true, it indicates that Splunk Observability Cloud is receiving over 100,000 metrics and tags from AWS. This property is read-only, and is only available if enableCheckLargeVolume is true. key: type: string format: password title: AWSKey description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the key.' metadataPollRate: title: Amazon CloudWatch Integration metadata poll rate type: integer format: int64 example: 900000 description: Specifies how often AWS metadata (tags and properties) are synchronized for the supported AWS services, in milliseconds. The default value is 15 minutes (900,000 ms), and can range from 1 minute to 1 hour. metricStatsToSync: title: Controls statistics per metric per namespace type: object additionalProperties: true example: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 description: 'A collection (associative array) of statistics to ingest for AWS metrics for AWS namespaces: Each primary key-value pair in the map specifies an AWS namespace name and a collection of metrics. Each key-value pair in the metrics collection specifies a metric name and an array of statistics. Considerations: The AWS namespace name can be up to 255 characters. It can''t start with a colon character (":"). The AWS metric name can be up to 255 characters. You can specify up to 10 statistics per metric. The API ignores blank, empty, or null statistics names. The API always returns the Splunk Observability Cloud form of a statistic name, regardless of its name in AWS. The statistics you can retrieve also depend on your use of AWS metric streams. For more information, see the Specify AWS statistics section in the Developer Guide for Splunk Observability Cloud.' metricStreamsSyncState: title: AWS CloudWatch Integration Metrics Streams Sync State type: string enum: - DISABLED - ENABLED - CANCELLING - CANCELLATION_FAILED example: ENABLED description: 'If set to ENABLED, enables AWS integration synchronization of Amazon CloudWatch Metrics Streams with Splunk Observability Cloud. The state indicator has four possible values: "DISABLED": Default. Only Splunk Observability Cloud can set the indicator to this value. Synchronization is disabled. "ENABLED"" Set this value to turn on synchronization. "CANCELLING": Set this value to turn off synchronization. This value triggers the cleanup procedure in your AWS account. The procedure deletes the AWS CloudWatch Metrics Streams objects in your account. Note: Change the state indicator to CANCELLING before you make any changes to the AWS policy that Splunk Observability Cloud uses. Splunk Observability Cloud still needs permissions set in the AWS policy in order to run the cleanup procedure. "CANCELLATION_FAILED": Returned by the API in the response body when the cleanup procedure failed. To retry the cancellation, change the value to "CANCELLING" and resend the request. The most common reason for a failed cancellation is a lack of required permissions. For example, if you first remove IAM permissions in AWS, you no longer have permission to run the cleanup procedure. Only Splunk Observability Cloud can set the indicator to this value. Note: CloudWatch Metric Streams doesn''t support filtering based on resource tags.' metricStreamsManagedExternally: type: boolean default: false example: true title: AWSMetricStreamsManagedExternally description: If set to true, Splunk Observability Cloud accepts data from Metric Streams managed from the AWS console. The AWS account sending the Metric Streams and the AWS account in the Splunk Observability Cloud integration have to match. namespacesExcludeTagSync: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' example: - AWS/ElasticBeanstalk - AWS/ElastiCache title: AWSNamespacesExcludeTagSync description: 'List of namespace names, defined by AWS, to exclude from tag metadata syncing. This property is similar to nameSpaceSyncRules, but namespacesExcludeTagSync excludes metadata rather than metrics for specific namespaces.' namespaceSyncRules: type: array minItems: 0 items: type: object required: - namespace properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNameSpaceSyncRule description: 'Namespace sync rule for a namespace defined by AWS. The rule contains the AWS namespace name and filter criteria. Splunk Observability Cloud applies the criteria to data coming in from the namespace.' title: AWSNameSpaceSyncRules description: 'List of AWS namespace sync rules. Each object contains a namespace name defined by AWS CloudWatch and filter criteria that Splunk Observability Cloud applies to data coming in from that namespace. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' prePauseState: type: string example: metricStreamsSyncState: ENABLED title: AWSPrePauseState description: Stores the integration's Metric Streams states previous to a change forced by modifying enabled. pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' inactiveMetricsPollRate: title: AWS CloudWatch Inactive Metrics Poll Rate type: integer format: int64 minimum: 60000 maximum: 3600000 example: 300000 description: 'Polling interval for AWS CloudWatch metrics that are not recently used. Splunk Observability Cloud applies this rate to metrics that have not been accessed by charts, detectors, or API queries within the recent usage window. The minimum value is 60000 ms (1 minute) and the maximum is 3600000 ms (60 minutes).' regions: type: array items: type: string enum: - ap-east-1 - ap-northeast-1 - ap-northeast-2 - ap-south-1 - ap-southeast-1 - ap-southeast-2 - ca-central-1 - eu-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - sa-east-1 - us-east-1 - us-east-2 - us-west-1 - us-west-2 example: - us-east-1 - us-east-2 - us-west-1 - us-west-2 title: AWSRegions description: 'List of AWS regions that you want Splunk Observability Cloud to monitor, in the form of a JSON array. See the list of AWS regions supported by Splunk Observability Cloud. If you omit the regions field or use "regions": [], the API adds all regular AWS regions to your integration. If you add the ec2:DescribeRegions permission to your AWS account, optional regions you''ve enabled on your AWS account will be enabled in Splunk Observability Cloud as well. If you want to enable a specific optional region, you need to do it before adding it to the integration. You can''t mix regions from different sets. For example, you can''t specify "regions": [ "eu-west-1", "cn-north-1"].' roleArn: type: string example: arn:aws:iam::123456789012:role/myIntegration title: AWSRoleArn description: 'Role ARN that you add to an existing AWS integration object. When you create an AWS integration object and specify "ExternalId" as the authentication method, Splunk Observability Cloud responds with an external ID. You provide this ID to AWS, which responds with a role ARN. To finish the connection between Splunk Observability Cloud and AWS, update the AWS integration object using a PUT request. In the request, specify roleArn property using the value you obtained from AWS. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNamespaceArray description: 'List of services, defined by AWS, for which you want Splunk Observability Cloud to collect data. This list refers to services by their AWS namespace names. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' sfxAwsAccountArn: title: Splunk Observability Cloud's AWS account ID description: Read-only. Specifies Splunk Observability Cloud's AWS account ID. It's used to establish a trust relationship with IAM when setting up IAM role used by the AWS integration. token: type: string format: password title: AWSToken description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the token.' syncCustomNamespacesOnly: type: boolean default: false example: true title: AWSSyncCustomNamespacesOnly description: Flag that controls the synchronization of metrics from custom AWS namespaces only. The default is false. If set to true, Splunk Observability Cloud only syncs metrics from custom AWS namespaces, and disregards metrics from built-in services. This is useful to limit data ingestion. syncLoadBalancerTargetGroupTags: type: boolean default: false example: true title: AWSSyncLoadBalancerTargetGroupTags description: 'This parameter is deprecated. Flag that controls the synchronization of Load Balancer Target group tags. If true, Splunk Observability Cloud syncs tags. The default is false. Note: To synchronize Load Balancer Target group tags, your AWS policy must include the permission elasticloadbalancing:DescribeTargetGroups. To learn more, see the Connect to AWS and send data to Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' required: - type - authMethod type: object description: 'Specifies the data collection integration between AWS CloudWatch and Splunk Observability Cloud, in the form of a JSON object.' - title: Amazon EventBridge Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' awsAccountId: title: Amazon EventBridge Integration Account ID type: string example: 123456789012 description: 'ID of the AWS account to use for the Amazon EventBridge integration. You get this value from AWS and send it to Splunk Observability Cloud when you create the integration.' eventSource: title: Amazon EventBridge Integration Event Source type: string example: aws.partner/buttercup.com/abcdefghijklmnopqrst description: 'String that identifies the Splunk Observability Cloud integration to Amazon EventBridge. Splunk Observability Cloud returns this string when you create the integration. The string has the format "/": "": Identifies Splunk Observability Cloud as the partner. Always aws.partner/observability.splunkcloud.com "": Splunk Observability Cloud event source identifier.' awsRegion: title: Amazon EventBridge Integration Region type: string example: ap-south-1 description: 'AWS region associated with the Amazon EventBridge integration. Each region that sends notifications needs its own integration. See the list of AWS regions supported by Splunk Observability Cloud.' type: type: string enum: - AmazonEventBridge example: AmazonEventBridge description: 'Type of service that this integration represents, in the form of an enumerated string, always "AmazonEventBridge".' required: - type type: object description: 'Specifies the properties of the integration between Amazon EventBridge and Splunk Observability Cloud, in the form of a JSON object' - title: Microsoft Azure Active Directory Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - AzureAD example: AzureAD description: 'Type of service that this integration represents, in the form of an enumerated string, always "AzureAD".' required: - type type: object description: 'Specifies the SAML integration between Azure Active Directory and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Azure Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' additionalServices: type: array items: type: string description: Name of a resource type to sync with Splunk Observability Cloud example: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices title: AzureAdditionalServices description: 'Additional Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. If you want to sync Azure resource types that Splunk Observability Cloud doesn''t fully support, add the types to the additionalServices array. The documentation for the services field contains a list of fully supported types. A resource type you specify in additionalServices must meet the following criteria: The type is a Azure GenericResource. For resource types that have hierarchical structure, only the root resource type is a GenericResource. For example, a Storage Account type can have a File Service type, and a File Service type can have a File Storage type. In this case, only Storage Account is a GenericResource. The resource type stores its metrics in Azure Monitor. To learn more about Azure Monitor, refer to the Microsoft Azure documentation. Splunk Observability Cloud syncs resource types that you specify in either services or additionalServices. If you add a resource type to both fields, Splunk Observability Cloud ignores the duplication.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' appId: type: string format: password title: AzureAppId description: 'Azure application ID for Splunk Observability Cloud. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' azureEnvironment: type: string enum: - AZURE - AZURE_US_GOVERNMENT example: AZURE title: AzureEnvironment description: 'Enumerated string that tells Splunk Observability Cloud what type of Azure integration this is. The allowed values are "AZURE_US_GOVERNMENT" and "AZURE". If you don''t specify a value in a POST request, Splunk Observability Cloud defaults to "AZURE".' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' secretKey: type: string format: password title: AzureSecretKey description: 'Azure secret key that associates Splunk Observability Cloud in Azure with the Azure tenant ID. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - microsoft.analysisservices/servers - microsoft.apimanagement/service - microsoft.automation/automationaccounts - microsoft.batch/batchaccounts - microsoft.cache/redis - microsoft.classiccompute/virtualmachines - microsoft.cognitiveservices/accounts - microsoft.compute/virtualmachines - microsoft.compute/virtualmachinescalesets - microsoft.compute/virtualmachinescalesets/virtualmachines - microsoft.containerinstance/containergroups - microsoft.containerservice/managedclusters - microsoft.customerinsights/hubs - microsoft.datafactory - microsoft.datafactory/datafactories - microsoft.datafactory/factories - microsoft.datalakeanalytics/accounts - microsoft.datalakestore/accounts - microsoft.dbformysql/servers - microsoft.dbforpostgresql/servers - microsoft.devices/elasticpools - microsoft.devices/elasticpools/iothubtenants - microsoft.devices/iothubs - microsoft.devices/provisioningservices - microsoft.documentdb/databaseaccounts - microsoft.eventhub/namespaces - microsoft.hdinsight/clusters - microsoft.keyvault/vaults - microsoft.locationbasedservices/accounts - microsoft.network/applicationgateways - microsoft.network/dnszones - microsoft.network/expressroutecircuits - microsoft.network/loadbalancers - microsoft.network/publicipaddresses - microsoft.network/trafficmanagerprofiles - microsoft.network/virtualnetworkgateways - microsoft.notificationhubs/namespaces/notificationhubs - microsoft.powerbidedicated/capacities - microsoft.relay/namespaces - microsoft.search/searchservices - microsoft.servicebus/namespaces - microsoft.sql/servers - microsoft.sql/servers/databases - microsoft.sql/servers/elasticpools - microsoft.storage/storageaccounts - microsoft.storage/storageaccounts/blobservices - microsoft.storage/storageaccounts/fileservices - microsoft.storage/storageaccounts/queueservices - microsoft.storage/storageaccounts/tableservices - microsoft.streamanalytics/streamingjobs - microsoft.web - microsoft.web/hostingenvironments/multirolepools - microsoft.web/hostingenvironments/workerpools - microsoft.web/serverfarms - microsoft.web/sites/slots example: - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs title: AzureServices description: 'List of Microsoft Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. Each element of services must be a resource type that Splunk Observability Cloud fully supports. The specification for array elements in services includes an enumerated list of fully supported types. To see the enumerated list of services, click the arrowhead to expand services, then click the arrowhead to expand ENUM. If you try to add a resource type that''s not in the enumerated list, Splunk Observability Cloud returns a 4xx HTTP response code. Even if the resource type isn''t listed, Splunk Observability Cloud might provide basic support for it. To learn more, see the documentation for the additionalServices field.' subscriptions: type: array items: type: string title: AzureSubscriptions description: 'List of Azure subscriptions that Splunk Observability Cloud should monitor, in the form of a JSON array of strings' resourceFilterRules: type: array items: type: object properties: filter: type: object properties: source: type: string example: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) description: Resource filter title: AzureResourceFilterRules description: 'List of rules to filter Azure resources by their tags. The source of each filter rule must be in the form filter(''key'', ''value''). You can join multiple filter statements using the and and or operators. Referenced keys are limited to tags and must be one of the following: tags prefixed with azure_tag_, or azure_resource_name, azure_resource_group_name or azure_kind.' tenantId: type: string example: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx title: AzureTenantId description: 'Azure ID of the Azure tenant. To learn how to get this ID, see the topic Prepare for Azure integration topic in the Splunk Observability Cloud user documentation.' useBatchApi: type: boolean title: AzureUseBatchApi description: false by default. If false, Splunk Observability Cloud uses the Azure Resource Manager Metrics List API to retrieve metrics. If useBatchApi is set to true, the Azure integration polls data using the Metrics Batch API (also known as the getBatch API or Data Plane API). Use this option to reduce observed throttling and latency. Note that Azure bills for requests to the Metrics Batch API. Refer to Azure documentation for more details. importAzureMonitor: type: boolean title: AzureImportAzureMonitor description: true by default. Controls how Splunk Observability Cloud imports Azure metrics. If set to false, metric sync is disabled, and only metadata is synced. type: type: string enum: - Azure example: Azure description: 'Type of service that this integration represents, in the form of an enumerated string, always "Azure".' syncGuestOsNamespaces: type: boolean example: true title: SyncGuestOsNamespaces description: 'Controls whether Splunk Observability Cloud syncs guest operating system (OS) namespaces. The default of false prevents Splunk Observability Cloud from retrieving metrics from guest OS namespace. Setting the field to true causes Splunk Observability Cloud to add metrics from the namespaces that the Azure Diagnostics extension recommends. These namespaces are are telegraf/mem, telegraf/cpu, and azure.vm.windows.guest. You can set syncGuestOsNamespaces to trueand specifycustomNamespacesPerService` at the same time.' customNamespacesPerService: type: object additionalProperties: type: string example: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace title: CustomNamespacesPerService description: 'Service-to-namespaces map that supports custom metrics for more fine-grained control of syncing. Default is empty. If you specify a map, Splunk Observability Cloud syncs metrics from namespaces in the map in addition to the default namespaces. The keys in customNamespacesPerService must be valid resource types. You can set syncGuestOsNamespaces to true and specify customNamespacesPerService at the same time.' required: - type type: object description: 'Specifies the data collection integration between Microsoft Azure and Splunk Observability Cloud, in the form of a JSON object.' - title: BigPanda Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' appKey: type: string format: password description: 'Application key you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' token: type: string format: password description: 'Token you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - BigPanda example: BigPanda description: 'Type of service that this integration represents, in the form of an enumerated string, always "BigPanda".' required: - type type: object description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Google Cloud Platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' customMetricTypeDomains: title: Custom GCP metrics list type: array example: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos items: type: string description: A single GCP service domain name you want to monitor. description: 'List of GCP service domain names that you want to monitor. Splunk Observability Cloud retrieves metrics from these service domains as well as the services you specify in the services field. If you specify an invalid service domain name, the system responds with an HTTP response code 400 and an error message. To learn more about the customMetricTypeDomains field, see the Custom metric type domains section in the Developer Guide for Splunk Observability Cloud.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' services: type: array items: type: string enum: - appengine - bigquery - bigtable - cloudfunctions - cloudiot - cloudsql - cloudtasks - compute - container - dataflow - datastore - firebasedatabase - firebasehosting - interconnect - loadbalancing - logging - ml - monitoring - pubsub - router - serviceruntime - spanner - storage - vpn example: - appengine - bigquery - bigtable title: GCPServices description: 'Array of GCP services that you want Splunk Observability Cloud to monitor. Splunk Observability Cloud only supports certain services, and if you specify an unsupported one, you receive an API error. The supported services are: "appengine" "bigquery" "bigtable" "cloudfunctions" "cloudiot" "cloudsql" "cloudtasks" "compute" "container" "dataflow" "datastore" "firebasedatabase" "firebasehosting" "interconnect" "loadbalancing" "logging" "ml" "monitoring" "pubsub" "router" "serviceruntime" "spanner" "storage" "vpn" To learn more, see the Connect to GCP topic in the Splunk Observability Cloud user documentation.' projects: title: GCPProjects type: object required: - selectedProjectIds properties: selectedProjectIds: type: array items: type: string example: - xxxxxx-yyyyyy-123456 description: A list of selected project ids. Use this only if syncMode is SELECTED. Only those projects will be synchronized. syncMode: type: string example: ALL_REACHABLE description: Valid values are ALL_REACHABLE or SELECTED. Mode of projects discovery ALL_REACHABLE - automatic synchronization of reachable projects. SELECTED - requires specifying a list of projects in selectedProjectIds. Only those projects will be synchronized. description: Project synchronization configuration. Allows you to choose synchronization mode - automatic synchronization or explicit list of projects. projectServiceKeys: type: array items: type: object required: - projectId - projectKey properties: projectId: type: string example: xxxxxx-yyyyyy-123456 description: GCP project ID you specified when you created your GCP project projectKey: type: string description: 'Contents of the GCP service account key file you generated when you created the project. Ensure that you escape special characters in this value before you you send it to Splunk Observability Cloud. Note: To ensure security, the API doesn''t return the value of this property in a response object.' title: GCPProjectServiceKey description: 'Properties of a GCP project, in the form of a JSON object. Contains the GCP project ID and GCP service account key for a GCP project that you want Splunk Observability Cloud to monitor.' title: GCPProjectServiceKeys description: 'List of GCP projects that you want Splunk Observability Cloud to monitor, in the form of a JSON array of objects' type: type: string enum: - GCP example: GCP description: 'Type of service that this integration represents, in the form of an enumerated string, always "GCP".' whitelist: deprecated: true description: DEPRECATED. Use includeList. includeList: type: array items: type: string minItems: 0 description: GCP metadata name example: - zone - labels - testkey1 - mywhitelist title: GCPIncludeList description: 'List of custom metadata keys that you want Splunk Observability Cloud to collect for GCP Compute Engine instances, in the form of a JSON array.' importGCPMetrics: type: boolean title: GCPImportGCPMetrics description: true by default. Controls how Splunk Observability Cloud imports GCP metrics. If set to false, metric sync is disabled, and only metadata is synced. useMetricSourceProjectForQuota: type: boolean items: type: boolean title: GCPUseMetricSourceProjectForQuota description: Set to true to use a quota from the project where metrics are stored. To use this, the project's service account requires a serviceusage.services.use permission, or you need a Service Usage Consumer role in the project. workloadIdentityFederationConfig: type: string title: GCPWorkloadIdentityFederationConfig description: Workload Identity Federation configuration exported from your account. Instructs Splunk Observability on how to authenticate to your GCP account. workloadIdentityFederationConfigs: deprecated: true type: array items: type: object title: GCPWorkloadIdentityFederationConfigs description: Pairs of projectId and wifConfig, where wifConfig is a Workload Identity Federation configuration. Deprecated. Use workloadIdentityFederationConfig and projects field instead. authMethod: type: string example: WORKLOAD_IDENTITY_FEDERATION title: GCPAuthMethod description: Authentication method. Valid values are WORKLOAD_IDENTITY_FEDERATION or SERVICE_ACCOUNT_KEY. If null it defaults to SERVICE_ACCOUNT_KEY wifSplunkIdentity: type: string readOnly: true example: service_account: splunk-observability@.iam.gserviceaccount.com title: GCPWifSplunkIdentity description: Splunk identity to use in Workload Identity Federation (WIF) attribute conditions and policy bindings excludeGCEInstancesWithLabels: title: GCP Compute Engine instance label exclusion list type: array items: type: string example: - goog-dataproc-cluster-uuid - custom-label description: 'List of label keys. GCP Compute Engine instances with any of these labels applied will be excluded from metric sync. To use this feature, the project''s service account requires a compute.instances.list permission. Note: You shall specify GCP labels as they appear in GCP without the gcp_label_ prefix.' required: - type type: object description: 'Specifies the data collection integration between Google Cloud Platform and Splunk Observability Cloud, in the form of a JSON object.' - title: Google Cloud Identity Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration type: type: string enum: - GoogleSaml example: GoogleSaml description: 'Type of service that this integration represents, in the form of an enumerated string, always "GoogleSaml".' required: - type type: object description: 'Specifies the SAML integration between Google Cloud Identity Integration Model and Splunk Observability Cloud, in the form of a JSON object.' - title: Jira Integration Request oneOf: - title: Jira Cloud Integration type: object required: - apiToken - userEmail properties: apiToken: title: API token for Jira Cloud user email type: string example: x9X9XXXXxXXxxxxXxXxX9999 description: 'API token for the user email you use in authentication credentials for a Jira Cloud integration.' userEmail: title: Jira Cloud User Email type: string format: email example: user@mydomain.atlassian.net description: 'Email address used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' description: Specific properties for integrating a Jira Cloud instance with Splunk Observability Cloud. - title: Jira Server Integration type: object required: - password - username properties: password: title: Jira Server User Password type: string format: password example: mypassword description: 'Password for the username used in Jira Server authentication credentials.' username: title: Jira Server User Name type: string example: myusername description: 'Username used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' description: Specific properties for integrating a Jira Server instance with Splunk Observability Cloud. example: enabled: true name: Jira Cloud integration for warning notifications type: Jira assignee: name: mtwain displayName: Mark Twain authMethod: EmailAndToken baseUrl: https://mycompany.buttercup.com issueType: Story projectKey: GEN userEmail: mtwain@example.com apiToken: x9X9XXXXxXXxxxxXxXxX9999 properties: enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' assignee: title: Jira ticket assignee type: object required: - name properties: name: title: Assignee user name type: string example: juser description: Jira user name for the assignee displayName: title: Assignee display name example: Jira User description: Jira display name for the assignee description: 'Username and optionally display name of the user to whom Jira assigns a new ticket for detector notifications. If you don''t specify this property when you create or update the integration, Splunk Observability Cloud uses the value of assignee from the detector that creates the alert notification. This lets you set a default assignee that individual detectors can override. If you don''t specify assignee for the integration or the detector, Jira uses its default value.' authMethod: title: Jira Integration Authentication Method type: string enum: - EmailAndToken - UsernameAndPassword example: EmailAndToken description: 'Authentication method to use when creating the Jira integration. The value must match the type of Jira instance you''re integrating with: Jira Cloud instance: "EmailAndToken" Jira Server instance: "UsernameAndPassword"' baseUrl: title: Jira Instance Base URL type: string format: url example: https://myjirainstance.atlassian.net description: 'Base URL of the Jira instance that''s integrated with Splunk Observability Cloud. The URL is supplied by Jira.' issueType: title: Jira issue type type: string example: Bug description: 'Issue type (for example, Story) for tickets that Jira creates for detector notifications Splunk Observability Cloud validates issue types, so you must specify a type that''s valid for the Jira project specified in projectKey.' projectKey: title: Jira Project Key type: string example: PRJ description: 'Jira key of an existing project. When Jira creates a new ticket for a detector notification, the ticket is assigned to this project.' type: type: string enum: - Jira example: Jira description: 'Type of service that this integration represents, in the form of an enumerated string, always "Jira".' required: - authMethod - baseUrl - issueType - projectKey - type type: object description: 'Set of properties used to create or update a Jira integration, in the form of a JSON object. This set includes properties common to all integrations and properties common to all Jira requests. Choose Jira Cloud Integration to view the properties for an integration with a Jira Cloud instance. Choose Jira Server Integration to view the properties for an integration with a Jira Server instance.' - title: Microsoft Teams Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' webhookUrl: title: Microsoft Teams Integration webhook URL type: string format: uri example: https://.webhook.office.com/webhook2/xxxxxxx description: 'Webhook URL provided by Microsoft Teams. When you create or update the integration, you must provide a Microsoft Teams URL known to Microsoft; otherwise, Microsoft rejects the request. To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - Office365 description: 'Type of service that this integration represents, in the form of an enumerated string. To ensure backward compatibility with previous versions of this integration, the type is "Office365".' required: - type type: object description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object.' - title: Okta Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - Okta example: Okta description: 'Type of service that this integration represents, in the form of an enumerated string, always "Okta".' required: - type type: object description: 'Specifies the SAML integration between Okta and Splunk Observability Cloud, in the form of a JSON object.' - title: OneLogin Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - OneLogin example: OneLogin description: 'Type of service that this integration represents, in the form of an enumerated string, always "OneLogin".' required: - type type: object description: 'Specifies the SAML integration between OneLogin and Splunk Observability Cloud, in the form of a JSON object.' - title: Opsgenie Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'An Opsgenie API key for sending alerts to an Opsgenie team or teams. Note: To ensure security, the API doesn''t return this property in response objects.' apiUrl: type: string format: url example: https://api.buttercup.com/ description: Your Opsgenie API URL type: type: string enum: - Opsgenie example: Opsgenie description: 'Type of service that this integration represents, in the form of an enumerated string, always "Opsgenie".' required: - apiKey - apiUrl - type type: object description: 'Specifies the properties of a notification service integration between Opsgenie and Splunk Observability Cloud, in the form of a JSON object' - title: PagerDuty Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'A key you get from PagerDuty that lets you integrate Splunk Observability Cloud with PagerDuty. PagerDuty refers to this property as the integrationKey. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - PagerDuty example: PagerDuty description: 'Type of service that this integration represents, in the form of an enumerated string, always "PagerDuty".' required: - type type: object description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object.' - title: PingOne Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' type: type: string enum: - PingOne example: PingOne description: 'Type of service that this integration represents, in the form of an enumerated string, always "PingOne".' required: - type type: object description: 'Specifies the SAML integration between PingOne and Splunk Observability Cloud, in the form of a JSON object.' - title: ServiceNow Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' instanceName: type: string example: anInstance.service-now.com description: 'ServiceNow instance name, for example myInstances.service-now.com. To learn more, see the Send alert notifications to ServiceNow using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' issueType: type: string enum: - Event - Incident - ImportSet - Problem example: Problem description: 'Type of issue, using standard ITIL terminology. This is an enumerated string that has the following possible values: Event Incident ImportSet Problem' username: type: string example: username description: 'Username you created in ServiceNow for the Splunk Observability Cloud integration. Note: In ServiceNow, you have to assign the roles web_service_admin and itil to this username.' password: type: string format: password description: 'Password associated with the username you created for this integration.' tableName: type: string example: u_incident_import description: Only applicable to integration instances with issueType of ImportSet value. Name of the custom table you created in ServiceNow. Splunk Observability Cloud sends requests to the specified table. type: type: string enum: - ServiceNow example: ServiceNow description: 'Type of service that this integration represents, in the form of an enumerated string, always "ServiceNow".' alertTriggeredPayloadTemplate: type: string example: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertResolvedPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow POST JSON payloads when an alert sends a notification to ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' alertResolvedPayloadTemplate: type: string example: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertTriggeredPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow PUT JSON payloads when an alert is cleared in ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' required: - type type: object description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - Webhook - OAuth example: OAuth description: 'Indicates the authentication method you want to use for integrating with the Slack API. This enumerated string has the following allowed values: Webhook OAuth' webhookUrl: type: string description: 'If you set "method": "Webhook", set "webhookUrl" to specify the incoming webhook URL. Note: To ensure security, the API doesn''t return this property in response objects.' scope: type: string description: 'If you set "method": "OAuth", set "scope" to specify the Slack OAuth scope string associated with this integration.' slackTeamName: type: string description: 'If you set "method": "OAuth", use "slackTeamName" to specify the name of the Slack team you''ve approved for this integration.' slackTeamId: type: string description: 'If you set the "method" property to "OAuth", use "slackTeamId" to specify the Slack ID for the Slack team you''ve approved for this integration.' slackUserId: type: string description: 'If you set the "method" property to "OAuth", use "slackUserId" to specify the Slack ID for the Slack user that approved this integration.' accessTokenUpdated: type: integer format: int64 example: 1555929030000 description: 'If you set the "method" property to "OAuth", "accessTokenUpdated" contains the last time that Slack refreshed or updated the access token. The value is in Unix time.' type: type: string enum: - Slack example: Slack description: 'Type of service that this integration represents, in the form of an enumerated string, always "Slack".' required: - type type: object description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk On-Call Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' postUrl: type: string description: 'Splunk On-Call API integration URL. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - VictorOps example: VictorOps description: 'Type of service that this integration represents, in the form of an enumerated string, always "VictorOps".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - SplunkPlatform example: SplunkPlatform description: 'Type of service that this integration represents, in the form of an enumerated string, always "SplunkPlatform"' url: type: string format: uri example: https://http-inputs-.splunkcloud.com description: Specify the HTTP Event Collector (HEC) URI for your Splunk platform instance. To learn more about HEC in Splunk platform, see the Send data to HTTP Event Collector section in the Documentation for Splunk Cloud Platform. hecToken: type: string example: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 description: 'HTTP Event Collector token that allows access to your Splunk platform instance. Splunk Observability Cloud doesn''t support HEC indexer acknowledgement. To use the Splunk platform integration, don''t activate indexer acknowledgement for HEC token in your Splunk Enterprise instance. Note: The value of hecToken isn''t returned in the response body.' payloadTemplate: type: string description: 'Customize the Splunk platform alert payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For the full list of supported variables, see the Supported variables for Splunk platform integration custom payload section in the Splunk Observability Cloud user documentation.' required: - type type: object description: Specifies the properties of a notification service integration between Splunk Observability Cloud and Splunk platform, in the form of a JSON object - title: Webhook Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - POST - PUT - GET example: POST default: POST description: HTTP method used to send webhook data. Valid methods include POST, PUT, and GET payloadTemplate: type: string example: severity: '{{{severity}}}' originatingMetric: '{{{originatingMetric}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' messageBody: '{{{encodeString messageBody}}}' src: '{{{src}}}' inputs: '{{{json inputs}}}' rule: '{{{encodeString rule}}}' description: '{{{encodeString description}}}' messageTitle: '{{{encodeString messageTitle}}}' sf_schema: '{{{sf_schema}}}' eventType: '{{{eventType}}}' runbookUrl: '{{{runbookUrl}}}' orgId: '{{{orgId}}}' detectorId: '{{{detectorId}}}' imageUrl: '{{{imageUrl}}}' tip: '{{{encodeString tip}}}' statusExtended: '{{{statusExtended}}}' incidentId: '{{{incidentId}}}' detector: '{{{encodeString detector}}}' detectorUrl: '{{{detectorUrl}}}' status: '{{{status}}}' timestamp: '{{{timestamp}}}' dimensions: '{{{json dimensions}}}' description: 'Customize the webhook payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For more information, see Webhook default payload. For the full list of supported variables, see the Integrate a webhook with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' url: type: string format: uri example: https://example.com/alarm/{{incidentId}}?status={{status}} description: Specify webhook's external site URL. You can use the Handlebars syntax for this URL. sharedSecret: type: string format: password description: 'Value that Splunk Observability Cloud uses as the secret cryptographic key in a message authentication code computation based on the HMAC-SHA256 algorithm. The Shared secret section in the Developer Guide for Splunk Observability Cloud describes the use sharedSecret in more detail. When you use sharedSecret, you need to know the steps Splunk Observability Cloud uses to compute the message authentication code, so you can perform the same computation and compare your results to a value you receive in the webhook request. sharedSecret is not returned in the response body.' headers: type: object example: Content-Type: application/json description: 'Associative array of HTTP headers and values, in the form of a JSON object. Splunk Observability Cloud adds the headers and values to HTTP requests sent to the webhook''s external site. When you provide a value for the payloadTemplate property, the headers property is used to determine expected payload type. When the headers property specifies "Content-Type" as "application/json" or "application/ld+json", Splunk Observability Cloud validates that the payload template produces a valid JSON objects. When no "Content-Type" is specified, Splunk Observability Cloud assumes you want to use a JSON payload and uses that validation.' type: type: string enum: - Webhook example: Webhook description: 'Type of service that this integration represents, in the form of an enumerated string, always "Webhook".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk Observability Cloud and an external site' - title: xMatters Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' url: type: string format: uri example: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' description: 'Webhook URL that connects the integration to your xMatters account. You get this URL from your xMatters account. To learn how, see the "SignalFx" topic in the "Integrations" section of the xMatters website.' type: type: string enum: - XMatters example: XMatters description: 'Type of service that this integration represents, in the form of an enumerated string, always "XMatters".' required: - type type: object description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' examples: Microsoft ADFS Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: ADFS AWS CloudWatch Integration: value: authMethod: ExternalId collectOnlyRecommendedStats: true created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customCloudWatchNamespaces: string customNamespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: string enableAwsUsage: true enableCheckLargeVolume: true enabled: true externalId: abcdefghijklmnopqrst id: XXxxxXXXXXX ignoreAllStatusMetrics: true importCloudWatch: true inactiveMetricsPollRate: 300000 includeEMRInstancesMetrics: true isLargeVolume: false key: string lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataPollRate: 900000 metricStatsToSync: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 metricStreamsManagedExternally: true metricStreamsSyncState: ENABLED name: MyIntegration namedToken: aCloudToken namespacesExcludeTagSync: - AWS/ElasticBeanstalk - AWS/ElastiCache namespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: AWS/DynamoDB pollRate: 60000 prePauseState: metricStreamsSyncState: ENABLED regions: - us-east-1 - us-east-2 - us-west-1 - us-west-2 roleArn: arn:aws:iam::123456789012:role/myIntegration services: - AWS/DynamoDB syncCustomNamespacesOnly: true syncLoadBalancerTargetGroupTags: true token: string type: AWSCloudWatch Amazon EventBridge Integration: value: awsAccountId: 123456789012 awsRegion: ap-south-1 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true eventSource: aws.partner/buttercup.com/abcdefghijklmnopqrst id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: AmazonEventBridge Microsoft Azure Active Directory Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: AzureAD Microsoft Azure Integration: value: additionalServices: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices appId: string azureEnvironment: AZURE created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customNamespacesPerService: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace enabled: true id: XXxxxXXXXXX importAzureMonitor: true lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 resourceFilterRules: - filter: source: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) secretKey: string services: - - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs subscriptions: - string syncGuestOsNamespaces: true tenantId: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx type: Azure useBatchApi: true BigPanda Integration: value: appKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration token: string type: BigPanda Google Cloud Platform Integration: value: authMethod: WORKLOAD_IDENTITY_FEDERATION created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customMetricTypeDomains: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos enabled: true excludeGCEInstancesWithLabels: - goog-dataproc-cluster-uuid - custom-label id: XXxxxXXXXXX importGCPMetrics: true includeList: - zone - labels - testkey1 - mywhitelist lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 projects: selectedProjectIds: - xxxxxx-yyyyyy-123456 syncMode: ALL_REACHABLE projectServiceKeys: - projectId: xxxxxx-yyyyyy-123456 projectKey: string services: - appengine - bigquery - bigtable type: GCP useMetricSourceProjectForQuota: true wifSplunkIdentity: service_account: splunk-observability@.iam.gserviceaccount.com workloadIdentityFederationConfig: string Google Cloud Identity Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: GoogleSaml Jira Integration Request: value: apiToken: x9X9XXXXxXXxxxxXxXxX9999 assignee: displayName: Mark Twain name: mtwain authMethod: EmailAndToken baseUrl: https://mycompany.buttercup.com enabled: true issueType: Story name: Jira Cloud integration for warning notifications projectKey: GEN type: Jira userEmail: mtwain@example.com Microsoft Teams Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Office365 webhookUrl: https://.webhook.office.com/webhook2/xxxxxxx Okta Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: Okta OneLogin Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: OneLogin Opsgenie Integration: value: apiKey: string apiUrl: https://api.buttercup.com/ created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Opsgenie PagerDuty Integration: value: apiKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: PagerDuty PingOne Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: PingOne ServiceNow Integration: value: alertResolvedPayloadTemplate: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' alertTriggeredPayloadTemplate: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX instanceName: anInstance.service-now.com issueType: Problem lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration password: string tableName: u_incident_import type: ServiceNow username: username Slack Integration: value: accessTokenUpdated: 1555929030000 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: OAuth name: MyIntegration scope: string slackTeamId: string slackTeamName: string slackUserId: string type: Slack webhookUrl: string Splunk On-Call Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration postUrl: string type: VictorOps Splunk platform Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true hecToken: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration payloadTemplate: string type: SplunkPlatform url: https://http-inputs-.splunkcloud.com Webhook Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true headers: Content-Type: application/json id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: POST name: MyIntegration payloadTemplate: description: '{{{encodeString description}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detector: '{{{encodeString detector}}}' detectorId: '{{{detectorId}}}' detectorUrl: '{{{detectorUrl}}}' dimensions: '{{{json dimensions}}}' eventType: '{{{eventType}}}' imageUrl: '{{{imageUrl}}}' incidentId: '{{{incidentId}}}' inputs: '{{{json inputs}}}' messageBody: '{{{encodeString messageBody}}}' messageTitle: '{{{encodeString messageTitle}}}' orgId: '{{{orgId}}}' originatingMetric: '{{{originatingMetric}}}' rule: '{{{encodeString rule}}}' runbookUrl: '{{{runbookUrl}}}' severity: '{{{severity}}}' sf_schema: '{{{sf_schema}}}' src: '{{{src}}}' status: '{{{status}}}' statusExtended: '{{{statusExtended}}}' timestamp: '{{{timestamp}}}' tip: '{{{encodeString tip}}}' sharedSecret: string type: Webhook url: https://example.com/alarm/{{incidentId}}?status={{status}} xMatters Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: XMatters url: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' responses: '200': description: HTTP 200 response content: application/json: schema: oneOf: - title: Microsoft ADFS Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - ADFS example: ADFS description: 'Type of service that this integration represents, in the form of an enumerated string, always "ADFS".' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration required: - type type: object description: 'Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.' - title: AWS CloudWatch Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' type: type: string enum: - AWSCloudWatch example: AWSCloudWatch description: 'Type of service that this integration represents, in the form of an enumerated string, always "AWSCloudWatch".' authMethod: title: AWS CloudWatch Integration Authentication Method type: string readOnly: false enum: - ExternalId - SecurityToken example: ExternalId description: 'Indicates the mechanism used to authenticate with AWS. The allowed values are: "ExternalId": Expects you to supply an external ID and ARN for AWS "SecurityToken": Expects you to supply a key and token Note: For the GovCloud and China AWS regions, you can only use "AuthMethod": "SecurityToken"' collectOnlyRecommendedStats: title: AWS CloudWatch Integration Collect Only Recommended Stats Flag type: boolean default: false description: 'If set to true, Splunk Observability Cloud collects only a subset of statistics for metrics specified in the list of AWS recommended stats. If a metric is not on the recommended stats list, the integration collects the 5 default statistics: SampleCount (count in Splunk Observability Cloud), Average (mean), Sum (sum), Minimum (lower), and Maximum (upper).' customCloudWatchNamespaces: title: AWS CloudWatch Custom Namespace List type: string description: 'Comma-separated string list that contains custom AWS CloudWatch namespaces to monitor. These can be either custom namespaces you''ve created in AWS, or any namespace defined by AWS that Splunk Observability Cloud doesn''t support by default. To see the list of AWS services that Splunk Observability Cloud supports by default, see Supported AWS services in the Splunk Observability Cloud user documentation. Custom namespaces provide additional metrics. customCloudWatchNamespaces and customNamespaceSyncRules are similar but not equivalent: customCloudWatchNamespaces is list of namespaces, and customNamespaceSyncRules is an array of objects that specify a namespace and data collection rules for that namespace. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, the system ignores the value of customCloudWatchNamespaces. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' customNamespaceSyncRules: title: AWS CloudWatch Custom Namespace Sync Rule List type: array items: title: AWS CloudWatch Custom Namespace Sync Rule type: object properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: title: AWS CloudWatch Custom Namespace type: string description: 'Name of an AWS CloudWatch namespace you created to contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the AWS documentation for publishing metrics.' description: 'Specifies AWS namespaces you created, and the filters that Splunk Observability Cloud applies to data coming from from those namespaces.' description: 'List of custom AWS namespaces and filters, in the form of a JSON array of JSON objects. Each object specifies data collection rules for a single AWS namespace. Custom namespaces are namespaces you created. They contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the Amazon AWS documentation for publishing metrics. customNamespaceSyncRules and customCloudWatchNamespaces are similar but not equivalent: customNamespaceSyncRules is a list of objects that specify a namespace and data collection rules for that namespace, and customCloudWatchNamespaces is a list of namespaces. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, Splunk Observability Cloud ignores the customCloudWatchNamespaces property. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' enableAwsUsage: type: boolean example: true title: EnableAwsUsage description: 'Controls how Splunk Observability Cloud imports usage metrics from AWS to use with AWS Optimizer. If true, Splunk Observability Cloud imports the metrics.' enableCheckLargeVolume: title: AWS CloudWatch Large Data Volume Flag type: boolean example: true description: Controls how Splunk Observability Cloud checks for large amounts of data for this AWS integration. This check only runs once. If true, Splunk Observability Cloud monitors the amount of data coming in from the integration. If over 100,000 metrics are fetched, the integration is disabled. You can re-enable the integration afterwards. externalId: title: AWS CloudWatch Integration External ID type: string readOnly: true example: abcdefghijklmnopqrst description: 'If you specify "authMethod": "ExternalId" in your request to create an AWS integration object, the response object contains a value for externalId. Use this value and the ARN value you get from AWS to update the integration object. Splunk Observability Cloud can then connect to AWS using the integration object. Note: Splunk Observability Cloud sets this value, and you can''t change it.' ignoreAllStatusMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: 'true by default. When set to true, the following metrics are ignored: StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System. When set to false, only StatusCheckFailed is ignored.' importCloudWatch: title: Amazon CloudWatch Integration Metrics Import Flag type: boolean example: true description: 'Controls how Splunk Observability Cloud imports AWS CloudWatch metrics. If true, Splunk Observability Cloud imports Cloud Watch metrics from AWS.' includeEMRInstancesMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: false by default. If true, it syncs Elastic Map Reduce EC2 instance metrics. EC2 EMR instances are identified by the aws:elasticmapreduce:job-flow-id tag put on an instance. isLargeVolume: title: AWS CloudWatch Integration Receiving Large Volume Flag type: boolean example: false description: If true, it indicates that Splunk Observability Cloud is receiving over 100,000 metrics and tags from AWS. This property is read-only, and is only available if enableCheckLargeVolume is true. key: type: string format: password title: AWSKey description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the key.' metadataPollRate: title: Amazon CloudWatch Integration metadata poll rate type: integer format: int64 example: 900000 description: Specifies how often AWS metadata (tags and properties) are synchronized for the supported AWS services, in milliseconds. The default value is 15 minutes (900,000 ms), and can range from 1 minute to 1 hour. metricStatsToSync: title: Controls statistics per metric per namespace type: object additionalProperties: true example: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 description: 'A collection (associative array) of statistics to ingest for AWS metrics for AWS namespaces: Each primary key-value pair in the map specifies an AWS namespace name and a collection of metrics. Each key-value pair in the metrics collection specifies a metric name and an array of statistics. Considerations: The AWS namespace name can be up to 255 characters. It can''t start with a colon character (":"). The AWS metric name can be up to 255 characters. You can specify up to 10 statistics per metric. The API ignores blank, empty, or null statistics names. The API always returns the Splunk Observability Cloud form of a statistic name, regardless of its name in AWS. The statistics you can retrieve also depend on your use of AWS metric streams. For more information, see the Specify AWS statistics section in the Developer Guide for Splunk Observability Cloud.' metricStreamsSyncState: title: AWS CloudWatch Integration Metrics Streams Sync State type: string enum: - DISABLED - ENABLED - CANCELLING - CANCELLATION_FAILED example: ENABLED description: 'If set to ENABLED, enables AWS integration synchronization of Amazon CloudWatch Metrics Streams with Splunk Observability Cloud. The state indicator has four possible values: "DISABLED": Default. Only Splunk Observability Cloud can set the indicator to this value. Synchronization is disabled. "ENABLED"" Set this value to turn on synchronization. "CANCELLING": Set this value to turn off synchronization. This value triggers the cleanup procedure in your AWS account. The procedure deletes the AWS CloudWatch Metrics Streams objects in your account. Note: Change the state indicator to CANCELLING before you make any changes to the AWS policy that Splunk Observability Cloud uses. Splunk Observability Cloud still needs permissions set in the AWS policy in order to run the cleanup procedure. "CANCELLATION_FAILED": Returned by the API in the response body when the cleanup procedure failed. To retry the cancellation, change the value to "CANCELLING" and resend the request. The most common reason for a failed cancellation is a lack of required permissions. For example, if you first remove IAM permissions in AWS, you no longer have permission to run the cleanup procedure. Only Splunk Observability Cloud can set the indicator to this value. Note: CloudWatch Metric Streams doesn''t support filtering based on resource tags.' metricStreamsManagedExternally: type: boolean default: false example: true title: AWSMetricStreamsManagedExternally description: If set to true, Splunk Observability Cloud accepts data from Metric Streams managed from the AWS console. The AWS account sending the Metric Streams and the AWS account in the Splunk Observability Cloud integration have to match. namespacesExcludeTagSync: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' example: - AWS/ElasticBeanstalk - AWS/ElastiCache title: AWSNamespacesExcludeTagSync description: 'List of namespace names, defined by AWS, to exclude from tag metadata syncing. This property is similar to nameSpaceSyncRules, but namespacesExcludeTagSync excludes metadata rather than metrics for specific namespaces.' namespaceSyncRules: type: array minItems: 0 items: type: object required: - namespace properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNameSpaceSyncRule description: 'Namespace sync rule for a namespace defined by AWS. The rule contains the AWS namespace name and filter criteria. Splunk Observability Cloud applies the criteria to data coming in from the namespace.' title: AWSNameSpaceSyncRules description: 'List of AWS namespace sync rules. Each object contains a namespace name defined by AWS CloudWatch and filter criteria that Splunk Observability Cloud applies to data coming in from that namespace. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' prePauseState: type: string example: metricStreamsSyncState: ENABLED title: AWSPrePauseState description: Stores the integration's Metric Streams states previous to a change forced by modifying enabled. pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' inactiveMetricsPollRate: title: AWS CloudWatch Inactive Metrics Poll Rate type: integer format: int64 minimum: 60000 maximum: 3600000 example: 300000 description: 'Polling interval for AWS CloudWatch metrics that are not recently used. Splunk Observability Cloud applies this rate to metrics that have not been accessed by charts, detectors, or API queries within the recent usage window. The minimum value is 60000 ms (1 minute) and the maximum is 3600000 ms (60 minutes).' regions: type: array items: type: string enum: - ap-east-1 - ap-northeast-1 - ap-northeast-2 - ap-south-1 - ap-southeast-1 - ap-southeast-2 - ca-central-1 - eu-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - sa-east-1 - us-east-1 - us-east-2 - us-west-1 - us-west-2 example: - us-east-1 - us-east-2 - us-west-1 - us-west-2 title: AWSRegions description: 'List of AWS regions that you want Splunk Observability Cloud to monitor, in the form of a JSON array. See the list of AWS regions supported by Splunk Observability Cloud. If you omit the regions field or use "regions": [], the API adds all regular AWS regions to your integration. If you add the ec2:DescribeRegions permission to your AWS account, optional regions you''ve enabled on your AWS account will be enabled in Splunk Observability Cloud as well. If you want to enable a specific optional region, you need to do it before adding it to the integration. You can''t mix regions from different sets. For example, you can''t specify "regions": [ "eu-west-1", "cn-north-1"].' roleArn: type: string example: arn:aws:iam::123456789012:role/myIntegration title: AWSRoleArn description: 'Role ARN that you add to an existing AWS integration object. When you create an AWS integration object and specify "ExternalId" as the authentication method, Splunk Observability Cloud responds with an external ID. You provide this ID to AWS, which responds with a role ARN. To finish the connection between Splunk Observability Cloud and AWS, update the AWS integration object using a PUT request. In the request, specify roleArn property using the value you obtained from AWS. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNamespaceArray description: 'List of services, defined by AWS, for which you want Splunk Observability Cloud to collect data. This list refers to services by their AWS namespace names. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' sfxAwsAccountArn: title: Splunk Observability Cloud's AWS account ID description: Read-only. Specifies Splunk Observability Cloud's AWS account ID. It's used to establish a trust relationship with IAM when setting up IAM role used by the AWS integration. token: type: string format: password title: AWSToken description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the token.' syncCustomNamespacesOnly: type: boolean default: false example: true title: AWSSyncCustomNamespacesOnly description: Flag that controls the synchronization of metrics from custom AWS namespaces only. The default is false. If set to true, Splunk Observability Cloud only syncs metrics from custom AWS namespaces, and disregards metrics from built-in services. This is useful to limit data ingestion. syncLoadBalancerTargetGroupTags: type: boolean default: false example: true title: AWSSyncLoadBalancerTargetGroupTags description: 'This parameter is deprecated. Flag that controls the synchronization of Load Balancer Target group tags. If true, Splunk Observability Cloud syncs tags. The default is false. Note: To synchronize Load Balancer Target group tags, your AWS policy must include the permission elasticloadbalancing:DescribeTargetGroups. To learn more, see the Connect to AWS and send data to Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' required: - type - authMethod type: object description: 'Specifies the data collection integration between AWS CloudWatch and Splunk Observability Cloud, in the form of a JSON object.' - title: Amazon EventBridge Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' awsAccountId: title: Amazon EventBridge Integration Account ID type: string example: 123456789012 description: 'ID of the AWS account to use for the Amazon EventBridge integration. You get this value from AWS and send it to Splunk Observability Cloud when you create the integration.' eventSource: title: Amazon EventBridge Integration Event Source type: string example: aws.partner/buttercup.com/abcdefghijklmnopqrst description: 'String that identifies the Splunk Observability Cloud integration to Amazon EventBridge. Splunk Observability Cloud returns this string when you create the integration. The string has the format "/": "": Identifies Splunk Observability Cloud as the partner. Always aws.partner/observability.splunkcloud.com "": Splunk Observability Cloud event source identifier.' awsRegion: title: Amazon EventBridge Integration Region type: string example: ap-south-1 description: 'AWS region associated with the Amazon EventBridge integration. Each region that sends notifications needs its own integration. See the list of AWS regions supported by Splunk Observability Cloud.' type: type: string enum: - AmazonEventBridge example: AmazonEventBridge description: 'Type of service that this integration represents, in the form of an enumerated string, always "AmazonEventBridge".' required: - type type: object description: 'Specifies the properties of the integration between Amazon EventBridge and Splunk Observability Cloud, in the form of a JSON object' - title: Microsoft Azure Active Directory Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - AzureAD example: AzureAD description: 'Type of service that this integration represents, in the form of an enumerated string, always "AzureAD".' required: - type type: object description: 'Specifies the SAML integration between Azure Active Directory and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Azure Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' additionalServices: type: array items: type: string description: Name of a resource type to sync with Splunk Observability Cloud example: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices title: AzureAdditionalServices description: 'Additional Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. If you want to sync Azure resource types that Splunk Observability Cloud doesn''t fully support, add the types to the additionalServices array. The documentation for the services field contains a list of fully supported types. A resource type you specify in additionalServices must meet the following criteria: The type is a Azure GenericResource. For resource types that have hierarchical structure, only the root resource type is a GenericResource. For example, a Storage Account type can have a File Service type, and a File Service type can have a File Storage type. In this case, only Storage Account is a GenericResource. The resource type stores its metrics in Azure Monitor. To learn more about Azure Monitor, refer to the Microsoft Azure documentation. Splunk Observability Cloud syncs resource types that you specify in either services or additionalServices. If you add a resource type to both fields, Splunk Observability Cloud ignores the duplication.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' appId: type: string format: password title: AzureAppId description: 'Azure application ID for Splunk Observability Cloud. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' azureEnvironment: type: string enum: - AZURE - AZURE_US_GOVERNMENT example: AZURE title: AzureEnvironment description: 'Enumerated string that tells Splunk Observability Cloud what type of Azure integration this is. The allowed values are "AZURE_US_GOVERNMENT" and "AZURE". If you don''t specify a value in a POST request, Splunk Observability Cloud defaults to "AZURE".' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' secretKey: type: string format: password title: AzureSecretKey description: 'Azure secret key that associates Splunk Observability Cloud in Azure with the Azure tenant ID. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - microsoft.analysisservices/servers - microsoft.apimanagement/service - microsoft.automation/automationaccounts - microsoft.batch/batchaccounts - microsoft.cache/redis - microsoft.classiccompute/virtualmachines - microsoft.cognitiveservices/accounts - microsoft.compute/virtualmachines - microsoft.compute/virtualmachinescalesets - microsoft.compute/virtualmachinescalesets/virtualmachines - microsoft.containerinstance/containergroups - microsoft.containerservice/managedclusters - microsoft.customerinsights/hubs - microsoft.datafactory - microsoft.datafactory/datafactories - microsoft.datafactory/factories - microsoft.datalakeanalytics/accounts - microsoft.datalakestore/accounts - microsoft.dbformysql/servers - microsoft.dbforpostgresql/servers - microsoft.devices/elasticpools - microsoft.devices/elasticpools/iothubtenants - microsoft.devices/iothubs - microsoft.devices/provisioningservices - microsoft.documentdb/databaseaccounts - microsoft.eventhub/namespaces - microsoft.hdinsight/clusters - microsoft.keyvault/vaults - microsoft.locationbasedservices/accounts - microsoft.network/applicationgateways - microsoft.network/dnszones - microsoft.network/expressroutecircuits - microsoft.network/loadbalancers - microsoft.network/publicipaddresses - microsoft.network/trafficmanagerprofiles - microsoft.network/virtualnetworkgateways - microsoft.notificationhubs/namespaces/notificationhubs - microsoft.powerbidedicated/capacities - microsoft.relay/namespaces - microsoft.search/searchservices - microsoft.servicebus/namespaces - microsoft.sql/servers - microsoft.sql/servers/databases - microsoft.sql/servers/elasticpools - microsoft.storage/storageaccounts - microsoft.storage/storageaccounts/blobservices - microsoft.storage/storageaccounts/fileservices - microsoft.storage/storageaccounts/queueservices - microsoft.storage/storageaccounts/tableservices - microsoft.streamanalytics/streamingjobs - microsoft.web - microsoft.web/hostingenvironments/multirolepools - microsoft.web/hostingenvironments/workerpools - microsoft.web/serverfarms - microsoft.web/sites/slots example: - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs title: AzureServices description: 'List of Microsoft Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. Each element of services must be a resource type that Splunk Observability Cloud fully supports. The specification for array elements in services includes an enumerated list of fully supported types. To see the enumerated list of services, click the arrowhead to expand services, then click the arrowhead to expand ENUM. If you try to add a resource type that''s not in the enumerated list, Splunk Observability Cloud returns a 4xx HTTP response code. Even if the resource type isn''t listed, Splunk Observability Cloud might provide basic support for it. To learn more, see the documentation for the additionalServices field.' subscriptions: type: array items: type: string title: AzureSubscriptions description: 'List of Azure subscriptions that Splunk Observability Cloud should monitor, in the form of a JSON array of strings' resourceFilterRules: type: array items: type: object properties: filter: type: object properties: source: type: string example: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) description: Resource filter title: AzureResourceFilterRules description: 'List of rules to filter Azure resources by their tags. The source of each filter rule must be in the form filter(''key'', ''value''). You can join multiple filter statements using the and and or operators. Referenced keys are limited to tags and must be one of the following: tags prefixed with azure_tag_, or azure_resource_name, azure_resource_group_name or azure_kind.' tenantId: type: string example: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx title: AzureTenantId description: 'Azure ID of the Azure tenant. To learn how to get this ID, see the topic Prepare for Azure integration topic in the Splunk Observability Cloud user documentation.' useBatchApi: type: boolean title: AzureUseBatchApi description: false by default. If false, Splunk Observability Cloud uses the Azure Resource Manager Metrics List API to retrieve metrics. If useBatchApi is set to true, the Azure integration polls data using the Metrics Batch API (also known as the getBatch API or Data Plane API). Use this option to reduce observed throttling and latency. Note that Azure bills for requests to the Metrics Batch API. Refer to Azure documentation for more details. importAzureMonitor: type: boolean title: AzureImportAzureMonitor description: true by default. Controls how Splunk Observability Cloud imports Azure metrics. If set to false, metric sync is disabled, and only metadata is synced. type: type: string enum: - Azure example: Azure description: 'Type of service that this integration represents, in the form of an enumerated string, always "Azure".' syncGuestOsNamespaces: type: boolean example: true title: SyncGuestOsNamespaces description: 'Controls whether Splunk Observability Cloud syncs guest operating system (OS) namespaces. The default of false prevents Splunk Observability Cloud from retrieving metrics from guest OS namespace. Setting the field to true causes Splunk Observability Cloud to add metrics from the namespaces that the Azure Diagnostics extension recommends. These namespaces are are telegraf/mem, telegraf/cpu, and azure.vm.windows.guest. You can set syncGuestOsNamespaces to trueand specifycustomNamespacesPerService` at the same time.' customNamespacesPerService: type: object additionalProperties: type: string example: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace title: CustomNamespacesPerService description: 'Service-to-namespaces map that supports custom metrics for more fine-grained control of syncing. Default is empty. If you specify a map, Splunk Observability Cloud syncs metrics from namespaces in the map in addition to the default namespaces. The keys in customNamespacesPerService must be valid resource types. You can set syncGuestOsNamespaces to true and specify customNamespacesPerService at the same time.' required: - type type: object description: 'Specifies the data collection integration between Microsoft Azure and Splunk Observability Cloud, in the form of a JSON object.' - title: BigPanda Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' appKey: type: string format: password description: 'Application key you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' token: type: string format: password description: 'Token you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - BigPanda example: BigPanda description: 'Type of service that this integration represents, in the form of an enumerated string, always "BigPanda".' required: - type type: object description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Google Cloud Platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' customMetricTypeDomains: title: Custom GCP metrics list type: array example: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos items: type: string description: A single GCP service domain name you want to monitor. description: 'List of GCP service domain names that you want to monitor. Splunk Observability Cloud retrieves metrics from these service domains as well as the services you specify in the services field. If you specify an invalid service domain name, the system responds with an HTTP response code 400 and an error message. To learn more about the customMetricTypeDomains field, see the Custom metric type domains section in the Developer Guide for Splunk Observability Cloud.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' services: type: array items: type: string enum: - appengine - bigquery - bigtable - cloudfunctions - cloudiot - cloudsql - cloudtasks - compute - container - dataflow - datastore - firebasedatabase - firebasehosting - interconnect - loadbalancing - logging - ml - monitoring - pubsub - router - serviceruntime - spanner - storage - vpn example: - appengine - bigquery - bigtable title: GCPServices description: 'Array of GCP services that you want Splunk Observability Cloud to monitor. Splunk Observability Cloud only supports certain services, and if you specify an unsupported one, you receive an API error. The supported services are: "appengine" "bigquery" "bigtable" "cloudfunctions" "cloudiot" "cloudsql" "cloudtasks" "compute" "container" "dataflow" "datastore" "firebasedatabase" "firebasehosting" "interconnect" "loadbalancing" "logging" "ml" "monitoring" "pubsub" "router" "serviceruntime" "spanner" "storage" "vpn" To learn more, see the Connect to GCP topic in the Splunk Observability Cloud user documentation.' projects: title: GCPProjects type: object required: - selectedProjectIds properties: selectedProjectIds: type: array items: type: string example: - xxxxxx-yyyyyy-123456 description: A list of selected project ids. Use this only if syncMode is SELECTED. Only those projects will be synchronized. syncMode: type: string example: ALL_REACHABLE description: Valid values are ALL_REACHABLE or SELECTED. Mode of projects discovery ALL_REACHABLE - automatic synchronization of reachable projects. SELECTED - requires specifying a list of projects in selectedProjectIds. Only those projects will be synchronized. description: Project synchronization configuration. Allows you to choose synchronization mode - automatic synchronization or explicit list of projects. projectServiceKeys: type: array items: type: object required: - projectId - projectKey properties: projectId: type: string example: xxxxxx-yyyyyy-123456 description: GCP project ID you specified when you created your GCP project projectKey: type: string description: 'Contents of the GCP service account key file you generated when you created the project. Ensure that you escape special characters in this value before you you send it to Splunk Observability Cloud. Note: To ensure security, the API doesn''t return the value of this property in a response object.' title: GCPProjectServiceKey description: 'Properties of a GCP project, in the form of a JSON object. Contains the GCP project ID and GCP service account key for a GCP project that you want Splunk Observability Cloud to monitor.' title: GCPProjectServiceKeys description: 'List of GCP projects that you want Splunk Observability Cloud to monitor, in the form of a JSON array of objects' type: type: string enum: - GCP example: GCP description: 'Type of service that this integration represents, in the form of an enumerated string, always "GCP".' whitelist: deprecated: true description: DEPRECATED. Use includeList. includeList: type: array items: type: string minItems: 0 description: GCP metadata name example: - zone - labels - testkey1 - mywhitelist title: GCPIncludeList description: 'List of custom metadata keys that you want Splunk Observability Cloud to collect for GCP Compute Engine instances, in the form of a JSON array.' importGCPMetrics: type: boolean title: GCPImportGCPMetrics description: true by default. Controls how Splunk Observability Cloud imports GCP metrics. If set to false, metric sync is disabled, and only metadata is synced. useMetricSourceProjectForQuota: type: boolean items: type: boolean title: GCPUseMetricSourceProjectForQuota description: Set to true to use a quota from the project where metrics are stored. To use this, the project's service account requires a serviceusage.services.use permission, or you need a Service Usage Consumer role in the project. workloadIdentityFederationConfig: type: string title: GCPWorkloadIdentityFederationConfig description: Workload Identity Federation configuration exported from your account. Instructs Splunk Observability on how to authenticate to your GCP account. workloadIdentityFederationConfigs: deprecated: true type: array items: type: object title: GCPWorkloadIdentityFederationConfigs description: Pairs of projectId and wifConfig, where wifConfig is a Workload Identity Federation configuration. Deprecated. Use workloadIdentityFederationConfig and projects field instead. authMethod: type: string example: WORKLOAD_IDENTITY_FEDERATION title: GCPAuthMethod description: Authentication method. Valid values are WORKLOAD_IDENTITY_FEDERATION or SERVICE_ACCOUNT_KEY. If null it defaults to SERVICE_ACCOUNT_KEY wifSplunkIdentity: type: string readOnly: true example: service_account: splunk-observability@.iam.gserviceaccount.com title: GCPWifSplunkIdentity description: Splunk identity to use in Workload Identity Federation (WIF) attribute conditions and policy bindings excludeGCEInstancesWithLabels: title: GCP Compute Engine instance label exclusion list type: array items: type: string example: - goog-dataproc-cluster-uuid - custom-label description: 'List of label keys. GCP Compute Engine instances with any of these labels applied will be excluded from metric sync. To use this feature, the project''s service account requires a compute.instances.list permission. Note: You shall specify GCP labels as they appear in GCP without the gcp_label_ prefix.' required: - type type: object description: 'Specifies the data collection integration between Google Cloud Platform and Splunk Observability Cloud, in the form of a JSON object.' - title: Google Cloud Identity Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration type: type: string enum: - GoogleSaml example: GoogleSaml description: 'Type of service that this integration represents, in the form of an enumerated string, always "GoogleSaml".' required: - type type: object description: 'Specifies the SAML integration between Google Cloud Identity Integration Model and Splunk Observability Cloud, in the form of a JSON object.' - title: Jira Integration Response example: created: 1556728926015 creator: X_xxxxXXXXX enabled: true id: XXxxxXXXXXX name: Jira Cloud integration for warning notifications type: Jira assignee: name: mtwain displayName: Mark Twain authMethod: EmailAndToken baseUrl: https://www.buttercup.com issueType: Story projectKey: GEN userEmail: mtwain@example.com lastUpdated: 1557513720143 lastUpdatedBy: X_xxxx5XXXX username: null password: null apiToken: null properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' assignee: title: Jira ticket assignee type: object required: - name properties: name: title: Assignee user name type: string example: juser description: Jira user name for the assignee displayName: title: Assignee display name example: Jira User description: Jira display name for the assignee description: 'Username and optionally display name of the user to whom Jira assigns a new ticket for detector notifications. If you don''t specify this property when you create or update the integration, Splunk Observability Cloud uses the value of assignee from the detector that creates the alert notification. This lets you set a default assignee that individual detectors can override. If you don''t specify assignee for the integration or the detector, Jira uses its default value.' authMethod: title: Jira Integration Authentication Method type: string enum: - EmailAndToken - UsernameAndPassword example: EmailAndToken description: 'Authentication method to use when creating the Jira integration. The value must match the type of Jira instance you''re integrating with: Jira Cloud instance: "EmailAndToken" Jira Server instance: "UsernameAndPassword"' baseUrl: title: Jira Instance Base URL type: string format: url example: https://myjirainstance.atlassian.net description: 'Base URL of the Jira instance that''s integrated with Splunk Observability Cloud. The URL is supplied by Jira.' issueType: title: Jira issue type type: string example: Bug description: 'Issue type (for example, Story) for tickets that Jira creates for detector notifications Splunk Observability Cloud validates issue types, so you must specify a type that''s valid for the Jira project specified in projectKey.' projectKey: title: Jira Project Key type: string example: PRJ description: 'Jira key of an existing project. When Jira creates a new ticket for a detector notification, the ticket is assigned to this project.' type: type: string enum: - Jira example: Jira description: 'Type of service that this integration represents, in the form of an enumerated string, always "Jira".' apiToken: title: API token for Jira Cloud user email type: string example: x9X9XXXXxXXxxxxXxXxX9999 description: 'API token for the user email you use in authentication credentials for a Jira Cloud integration.' userEmail: title: Jira Cloud User Email type: string format: email example: user@mydomain.atlassian.net description: 'Email address used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' password: title: Jira Server User Password type: string format: password example: mypassword description: 'Password for the username used in Jira Server authentication credentials.' username: title: Jira Server User Name type: string example: myusername description: 'Username used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' required: - type type: object description: 'Properties returned from Splunk Observability Cloud when you create, retrieve or update an integration between Jira and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Teams Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' webhookUrl: title: Microsoft Teams Integration webhook URL type: string format: uri example: https://.webhook.office.com/webhook2/xxxxxxx description: 'Webhook URL provided by Microsoft Teams. When you create or update the integration, you must provide a Microsoft Teams URL known to Microsoft; otherwise, Microsoft rejects the request. To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - Office365 description: 'Type of service that this integration represents, in the form of an enumerated string. To ensure backward compatibility with previous versions of this integration, the type is "Office365".' required: - type type: object description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object.' - title: Okta Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - Okta example: Okta description: 'Type of service that this integration represents, in the form of an enumerated string, always "Okta".' required: - type type: object description: 'Specifies the SAML integration between Okta and Splunk Observability Cloud, in the form of a JSON object.' - title: OneLogin Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - OneLogin example: OneLogin description: 'Type of service that this integration represents, in the form of an enumerated string, always "OneLogin".' required: - type type: object description: 'Specifies the SAML integration between OneLogin and Splunk Observability Cloud, in the form of a JSON object.' - title: Opsgenie Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'An Opsgenie API key for sending alerts to an Opsgenie team or teams. Note: To ensure security, the API doesn''t return this property in response objects.' apiUrl: type: string format: url example: https://api.buttercup.com/ description: Your Opsgenie API URL type: type: string enum: - Opsgenie example: Opsgenie description: 'Type of service that this integration represents, in the form of an enumerated string, always "Opsgenie".' required: - apiKey - apiUrl - type type: object description: 'Specifies the properties of a notification service integration between Opsgenie and Splunk Observability Cloud, in the form of a JSON object' - title: PagerDuty Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'A key you get from PagerDuty that lets you integrate Splunk Observability Cloud with PagerDuty. PagerDuty refers to this property as the integrationKey. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - PagerDuty example: PagerDuty description: 'Type of service that this integration represents, in the form of an enumerated string, always "PagerDuty".' required: - type type: object description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object.' - title: PingOne Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' type: type: string enum: - PingOne example: PingOne description: 'Type of service that this integration represents, in the form of an enumerated string, always "PingOne".' required: - type type: object description: 'Specifies the SAML integration between PingOne and Splunk Observability Cloud, in the form of a JSON object.' - title: ServiceNow Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' instanceName: type: string example: anInstance.service-now.com description: 'ServiceNow instance name, for example myInstances.service-now.com. To learn more, see the Send alert notifications to ServiceNow using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' issueType: type: string enum: - Event - Incident - ImportSet - Problem example: Problem description: 'Type of issue, using standard ITIL terminology. This is an enumerated string that has the following possible values: Event Incident ImportSet Problem' username: type: string example: username description: 'Username you created in ServiceNow for the Splunk Observability Cloud integration. Note: In ServiceNow, you have to assign the roles web_service_admin and itil to this username.' password: type: string format: password description: 'Password associated with the username you created for this integration.' tableName: type: string example: u_incident_import description: Only applicable to integration instances with issueType of ImportSet value. Name of the custom table you created in ServiceNow. Splunk Observability Cloud sends requests to the specified table. type: type: string enum: - ServiceNow example: ServiceNow description: 'Type of service that this integration represents, in the form of an enumerated string, always "ServiceNow".' alertTriggeredPayloadTemplate: type: string example: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertResolvedPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow POST JSON payloads when an alert sends a notification to ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' alertResolvedPayloadTemplate: type: string example: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertTriggeredPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow PUT JSON payloads when an alert is cleared in ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' required: - type type: object description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - Webhook - OAuth example: OAuth description: 'Indicates the authentication method you want to use for integrating with the Slack API. This enumerated string has the following allowed values: Webhook OAuth' webhookUrl: type: string description: 'If you set "method": "Webhook", set "webhookUrl" to specify the incoming webhook URL. Note: To ensure security, the API doesn''t return this property in response objects.' scope: type: string description: 'If you set "method": "OAuth", set "scope" to specify the Slack OAuth scope string associated with this integration.' slackTeamName: type: string description: 'If you set "method": "OAuth", use "slackTeamName" to specify the name of the Slack team you''ve approved for this integration.' slackTeamId: type: string description: 'If you set the "method" property to "OAuth", use "slackTeamId" to specify the Slack ID for the Slack team you''ve approved for this integration.' slackUserId: type: string description: 'If you set the "method" property to "OAuth", use "slackUserId" to specify the Slack ID for the Slack user that approved this integration.' accessTokenUpdated: type: integer format: int64 example: 1555929030000 description: 'If you set the "method" property to "OAuth", "accessTokenUpdated" contains the last time that Slack refreshed or updated the access token. The value is in Unix time.' type: type: string enum: - Slack example: Slack description: 'Type of service that this integration represents, in the form of an enumerated string, always "Slack".' required: - type type: object description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk On-Call Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' postUrl: type: string description: 'Splunk On-Call API integration URL. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - VictorOps example: VictorOps description: 'Type of service that this integration represents, in the form of an enumerated string, always "VictorOps".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - SplunkPlatform example: SplunkPlatform description: 'Type of service that this integration represents, in the form of an enumerated string, always "SplunkPlatform"' url: type: string format: uri example: https://http-inputs-.splunkcloud.com description: Specify the HTTP Event Collector (HEC) URI for your Splunk platform instance. To learn more about HEC in Splunk platform, see the Send data to HTTP Event Collector section in the Documentation for Splunk Cloud Platform. hecToken: type: string example: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 description: 'HTTP Event Collector token that allows access to your Splunk platform instance. Splunk Observability Cloud doesn''t support HEC indexer acknowledgement. To use the Splunk platform integration, don''t activate indexer acknowledgement for HEC token in your Splunk Enterprise instance. Note: The value of hecToken isn''t returned in the response body.' payloadTemplate: type: string description: 'Customize the Splunk platform alert payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For the full list of supported variables, see the Supported variables for Splunk platform integration custom payload section in the Splunk Observability Cloud user documentation.' required: - type type: object description: Specifies the properties of a notification service integration between Splunk Observability Cloud and Splunk platform, in the form of a JSON object - title: Webhook Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - POST - PUT - GET example: POST default: POST description: HTTP method used to send webhook data. Valid methods include POST, PUT, and GET payloadTemplate: type: string example: severity: '{{{severity}}}' originatingMetric: '{{{originatingMetric}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' messageBody: '{{{encodeString messageBody}}}' src: '{{{src}}}' inputs: '{{{json inputs}}}' rule: '{{{encodeString rule}}}' description: '{{{encodeString description}}}' messageTitle: '{{{encodeString messageTitle}}}' sf_schema: '{{{sf_schema}}}' eventType: '{{{eventType}}}' runbookUrl: '{{{runbookUrl}}}' orgId: '{{{orgId}}}' detectorId: '{{{detectorId}}}' imageUrl: '{{{imageUrl}}}' tip: '{{{encodeString tip}}}' statusExtended: '{{{statusExtended}}}' incidentId: '{{{incidentId}}}' detector: '{{{encodeString detector}}}' detectorUrl: '{{{detectorUrl}}}' status: '{{{status}}}' timestamp: '{{{timestamp}}}' dimensions: '{{{json dimensions}}}' description: 'Customize the webhook payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For more information, see Webhook default payload. For the full list of supported variables, see the Integrate a webhook with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' url: type: string format: uri example: https://example.com/alarm/{{incidentId}}?status={{status}} description: Specify webhook's external site URL. You can use the Handlebars syntax for this URL. sharedSecret: type: string format: password description: 'Value that Splunk Observability Cloud uses as the secret cryptographic key in a message authentication code computation based on the HMAC-SHA256 algorithm. The Shared secret section in the Developer Guide for Splunk Observability Cloud describes the use sharedSecret in more detail. When you use sharedSecret, you need to know the steps Splunk Observability Cloud uses to compute the message authentication code, so you can perform the same computation and compare your results to a value you receive in the webhook request. sharedSecret is not returned in the response body.' headers: type: object example: Content-Type: application/json description: 'Associative array of HTTP headers and values, in the form of a JSON object. Splunk Observability Cloud adds the headers and values to HTTP requests sent to the webhook''s external site. When you provide a value for the payloadTemplate property, the headers property is used to determine expected payload type. When the headers property specifies "Content-Type" as "application/json" or "application/ld+json", Splunk Observability Cloud validates that the payload template produces a valid JSON objects. When no "Content-Type" is specified, Splunk Observability Cloud assumes you want to use a JSON payload and uses that validation.' type: type: string enum: - Webhook example: Webhook description: 'Type of service that this integration represents, in the form of an enumerated string, always "Webhook".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk Observability Cloud and an external site' - title: xMatters Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' url: type: string format: uri example: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' description: 'Webhook URL that connects the integration to your xMatters account. You get this URL from your xMatters account. To learn how, see the "SignalFx" topic in the "Integrations" section of the xMatters website.' type: type: string enum: - XMatters example: XMatters description: 'Type of service that this integration represents, in the form of an enumerated string, always "XMatters".' required: - type type: object description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' examples: Microsoft ADFS Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: ADFS AWS CloudWatch Integration: value: authMethod: ExternalId collectOnlyRecommendedStats: true created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customCloudWatchNamespaces: string customNamespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: string enableAwsUsage: true enableCheckLargeVolume: true enabled: true externalId: abcdefghijklmnopqrst id: XXxxxXXXXXX ignoreAllStatusMetrics: true importCloudWatch: true inactiveMetricsPollRate: 300000 includeEMRInstancesMetrics: true isLargeVolume: false key: string lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataPollRate: 900000 metricStatsToSync: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 metricStreamsManagedExternally: true metricStreamsSyncState: ENABLED name: MyIntegration namedToken: aCloudToken namespacesExcludeTagSync: - AWS/ElasticBeanstalk - AWS/ElastiCache namespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: AWS/DynamoDB pollRate: 60000 prePauseState: metricStreamsSyncState: ENABLED regions: - us-east-1 - us-east-2 - us-west-1 - us-west-2 roleArn: arn:aws:iam::123456789012:role/myIntegration services: - AWS/DynamoDB syncCustomNamespacesOnly: true syncLoadBalancerTargetGroupTags: true token: string type: AWSCloudWatch Amazon EventBridge Integration: value: awsAccountId: 123456789012 awsRegion: ap-south-1 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true eventSource: aws.partner/buttercup.com/abcdefghijklmnopqrst id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: AmazonEventBridge Microsoft Azure Active Directory Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: AzureAD Microsoft Azure Integration: value: additionalServices: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices appId: string azureEnvironment: AZURE created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customNamespacesPerService: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace enabled: true id: XXxxxXXXXXX importAzureMonitor: true lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 resourceFilterRules: - filter: source: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) secretKey: string services: - - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs subscriptions: - string syncGuestOsNamespaces: true tenantId: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx type: Azure useBatchApi: true BigPanda Integration: value: appKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration token: string type: BigPanda Google Cloud Platform Integration: value: authMethod: WORKLOAD_IDENTITY_FEDERATION created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customMetricTypeDomains: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos enabled: true excludeGCEInstancesWithLabels: - goog-dataproc-cluster-uuid - custom-label id: XXxxxXXXXXX importGCPMetrics: true includeList: - zone - labels - testkey1 - mywhitelist lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 projects: selectedProjectIds: - xxxxxx-yyyyyy-123456 syncMode: ALL_REACHABLE projectServiceKeys: - projectId: xxxxxx-yyyyyy-123456 projectKey: string services: - appengine - bigquery - bigtable type: GCP useMetricSourceProjectForQuota: true wifSplunkIdentity: service_account: splunk-observability@.iam.gserviceaccount.com workloadIdentityFederationConfig: string Google Cloud Identity Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: GoogleSaml Jira Integration Response: value: apiToken: null assignee: displayName: Mark Twain name: mtwain authMethod: EmailAndToken baseUrl: https://www.buttercup.com created: 1556728926015 creator: X_xxxxXXXXX enabled: true id: XXxxxXXXXXX issueType: Story lastUpdated: 1557513720143 lastUpdatedBy: X_xxxx5XXXX name: Jira Cloud integration for warning notifications password: null projectKey: GEN type: Jira userEmail: mtwain@example.com username: null Microsoft Teams Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Office365 webhookUrl: https://.webhook.office.com/webhook2/xxxxxxx Okta Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: Okta OneLogin Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: OneLogin Opsgenie Integration: value: apiKey: string apiUrl: https://api.buttercup.com/ created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Opsgenie PagerDuty Integration: value: apiKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: PagerDuty PingOne Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: PingOne ServiceNow Integration: value: alertResolvedPayloadTemplate: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' alertTriggeredPayloadTemplate: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX instanceName: anInstance.service-now.com issueType: Problem lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration password: string tableName: u_incident_import type: ServiceNow username: username Slack Integration: value: accessTokenUpdated: 1555929030000 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: OAuth name: MyIntegration scope: string slackTeamId: string slackTeamName: string slackUserId: string type: Slack webhookUrl: string Splunk On-Call Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration postUrl: string type: VictorOps Splunk platform Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true hecToken: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration payloadTemplate: string type: SplunkPlatform url: https://http-inputs-.splunkcloud.com Webhook Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true headers: Content-Type: application/json id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: POST name: MyIntegration payloadTemplate: description: '{{{encodeString description}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detector: '{{{encodeString detector}}}' detectorId: '{{{detectorId}}}' detectorUrl: '{{{detectorUrl}}}' dimensions: '{{{json dimensions}}}' eventType: '{{{eventType}}}' imageUrl: '{{{imageUrl}}}' incidentId: '{{{incidentId}}}' inputs: '{{{json inputs}}}' messageBody: '{{{encodeString messageBody}}}' messageTitle: '{{{encodeString messageTitle}}}' orgId: '{{{orgId}}}' originatingMetric: '{{{originatingMetric}}}' rule: '{{{encodeString rule}}}' runbookUrl: '{{{runbookUrl}}}' severity: '{{{severity}}}' sf_schema: '{{{sf_schema}}}' src: '{{{src}}}' status: '{{{status}}}' statusExtended: '{{{statusExtended}}}' timestamp: '{{{timestamp}}}' tip: '{{{encodeString tip}}}' sharedSecret: string type: Webhook url: https://example.com/alarm/{{incidentId}}?status={{status}} xMatters Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: XMatters url: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' '400': description: HTTP 400 response content: application/json: schema: oneOf: - title: AWS CloudWatch failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text message for the error. Always "Poll rate value x ms is out of the range. Supported poll rate values are 60000 - 600000 ms.", where x is the polling rate specified in the request.' title: AWSIntegrationFailurePollRateValue description: 'Request failed because the specified polling rate is out of range. The API only accepts values between 60000 (1 minute in milliseconds) and 600000 (10 minutes in milliseconds).' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Unknown namedToken value: "' example: code: 400 example: 'Unknown namedToken value: my-org-token' title: CommonIntegrationFailureInvalidOrgToken description: 'Request failed because Splunk Observability Cloud can''t find any access tokens (or org tokens) that have the name you specified in namedToken. This error message can only occur in response to the following operations: POST integration: Create an integration PUT integration/{INTEGRATION_ID>}: Update an existing integration' description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a create or update request for an AWS CloudWatch integration. The code property is always in the 4xx HTTP response code range. The message property value depends on the type of failure.' - title: Generic failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Unknown namedToken value: "' example: code: 400 example: 'Unknown namedToken value: my-org-token' title: CommonIntegrationFailureInvalidOrgToken description: 'Request failed because Splunk Observability Cloud can''t find any access tokens (or org tokens) that have the name you specified in namedToken. This error message can only occur in response to the following operations: POST integration: Create an integration PUT integration/{INTEGRATION_ID>}: Update an existing integration' description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a create, retrieve, update, or delete request for any of the possible integrations The code property is always in the 4xx HTTP response code range. The message property value depends on the type of failure.' - title: Google Cloud Platform invalid integration request responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Unknown namedToken value: "' example: code: 400 example: 'Unknown namedToken value: my-org-token' title: CommonIntegrationFailureInvalidOrgToken description: 'Request failed because Splunk Observability Cloud can''t find any access tokens (or org tokens) that have the name you specified in namedToken. This error message can only occur in response to the following operations: POST integration: Create an integration PUT integration/{INTEGRATION_ID>}: Update an existing integration' - title: Google Cloud Platform response for invalid custom metric type domain properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: "Human-readable text message for the error. Contains the text Invalid customMetricTypeDomains:\ \ \nfollowed by a comma-separated list of invalid custom metric type domains." description: 'Splunk Observability Cloud response for a Google Cloud Platform (GCP) integration request, when the custMetricTypeDomains field in the request contains an invalid custom metric type domain. The response is a JSON object containing a numeric HTTP response code and a text message.' description: 'Response body from Splunk Observability Cloud when a Google Cloud Platform (GCP) integration POST or PUT request (create or update) is invalid. The code property is always in the 4xx HTTP response code range. The message property describes what is wrong with the request.' - title: Jira failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error Always "Expected single issue type in Jira response, got [ ]. Unknown issue type."' example: code: 400 message: Expected single issue type in Jira response, got [ ]. Unknown issue type. title: JiraIntegrationFailureInvalidIssueType description: 'Request failed because the specified Jira issue type is invalid. Splunk Observability Cloud validates issue types to ensure that the type exists for the specified Jira project.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Expected single project in Jira response, got { "projects" : [ ] }. User may not exist or does not have permissions to browse projects."' example: code: 400 message: '"Expected single project in Jira response, got { \"projects\" : [ ] }. User may not exist or does not have permissions to browse projects." ' title: JiraIntegrationFailureUnknownUser description: 'Request failed because of one of the following Jira user errors: Jira user is not well-formed Jira user is not known to Jira Jira user doesn''t have the proper authorization' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Expected single project in Jira response, got { "projects" : [ ] }. User may not exist or does not have permissions to browse projects."' example: code: 400 message: '"Expected single project in Jira response, got { \"projects\" : [ ] }. User may not exist or does not have permissions to browse projects." ' title: JiraIntegrationFailureUnknownProject description: Request failed because the specified Jira project doesn't exist - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Failed to de-serialize payload at: sf.rest.shared.model.integration.JiraIntegration["authMethod"]"' example: code: 400 message: '"Failed to de-serialize payload at: sf.rest.shared.model.integration.JiraIntegration[\"authMethod\"]" ' title: JiraIntegrationFailureUnknownAuthMethod description: 'Request failed because the specified Jira authentication method doesn''t exist' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error. Might contain debug output. example: code: 400 message: Invalid token title: JiraIntegrationFailureInvalidApiToken description: Request failed because the specified Jira API token is invalid description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a create, retrieve, update, or delete request for a Jira integration The code property is always in the 4xx HTTP response code range. The message property value depends on the type of failure. In some cases, the message comes directly from the Jira instance rather than from Splunk Observability Cloud.' - title: Microsoft Teams failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error example: code: 400 message: WebhookUrl is invalid title: MSTeamsIntegrationFailureInvalidWebhookUrl description: Request failed because the webhook URL is not well-formed - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error example: code: 400 message: MSTeams API returns '400 Bad Request' Invalid webhook URL title: MSTeamsIntegrationFailureInvalidWebhookUrlMS description: Request failed because Microsoft rejected the specified webhook URL - type: object properties: code: type: integer description: HTTP response code. Always 410 (Gone) message: type: string description: Human-readable text for the error example: code: 410 message: Connector configuration not found title: MSTeamsIntegrationFailureMissingConnector description: Request failed because user didn't save connector information in MS Teams - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error example: code: 400 message: WebhookUrl is missing title: MSTeamsIntegrationFailureNoWebhookUrl description: Request failed because webhook URL is missing description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a Microsoft Teams integration request. The code and message properties depend on the type of failure. Two different failures might occur because of an invalid webhook URL. Splunk Observability Cloud returns the following messages: "WebhookUrl is invalid". Returned when the URL is not well-formed "Office365 API returns ''400 Bad Request'' Invalid webhook URL". Returned when Microsoft rejects the specified webhook URL' examples: AWSBadRequest: value: code: 400 message: Poll rate value 1 ms is out of the range. Supported poll rate values are 60000 - 600000 ms. GCPBadRequest: value: code: 400 message: 'Invalid customMetricTypeDomains: agent.googleapis.com/agnt, extrnal.googleapis.com/prometheus' GenericBadRequest: value: code: 401 message: 'HTTP ERROR 401 Problem accessing /v2/integration. Reason: Unauthorized' JiraBadRequest: value: code: 400 message: Expected single issue type in Jira response, got [ ]. Unknown issue type. '500': description: HTTP 500 response content: application/json: schema: oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 500 (Internal Server Error) message: type: string description: 'Human-readable error text. Has the form "Integration type not found" where is the integration type specified in the request' example: code: 500 message: Integration type 'Office366' not found title: CommonIntegrationFailureBadTypeInPayload description: Request failed because the specified integration type is invalid examples: GenericBadRequest: value: code: 500 message: Integration type not found security: - SessionToken: [] tags: - Integrations /integration/{id}: get: summary: Retrieve Single Integration description: 'Retrieves the integration object specified by the id path parameter. Note: To ensure security, the API omits some authentication and authorization properties from response objects. Jira integration: For a Jira integration request, the response body contains a union of the following response properties: Properties common to all integration responses Properties common to all Jira integration responses Authentication credential properties for Jira Cloud integrations Authentication credential properties for Jira Server integrations Some Jira integration properties are set to null in the response: Optional properties that you didn''t specify in your creation request Password or API token, to ensure security Properties not used for a specific type of Jira integration. For example, if you integrate with Jira Cloud, the response body contains "username": null because username isn''t a valid property for a Jira Cloud integration.' parameters: - name: id in: path description: 'ID of the existing integration object that you want to retrieve' required: true schema: type: string - name: userParam in: query description: 'Return user name values in the response based on the full name value from the user''s profile. To return the name of the user who created the integration, specify userParam=creator. The system responds by populating the createdByName field with the name of the user who created the integration, instead of the default value of null. To return the name of the user who last updated the integration, specify userParam=lastUpdatedBy. The system responds by populating the lastUpdatedByName field with the name of the user who last updated the integration, instead of the default value of null. You can specify one or both parameter values. For example, to include both parameters, specify userParam=creator&userParam=lastUpdatedBy. This property is an enumerated string, and only the enumerated values are allowed.' schema: type: string enum: - creator - lastUpdatedBy - name: X-SF-Token in: header description: Authentication token required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: oneOf: - title: Microsoft ADFS Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - ADFS example: ADFS description: 'Type of service that this integration represents, in the form of an enumerated string, always "ADFS".' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration required: - type type: object description: 'Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.' - title: AWS CloudWatch Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' type: type: string enum: - AWSCloudWatch example: AWSCloudWatch description: 'Type of service that this integration represents, in the form of an enumerated string, always "AWSCloudWatch".' authMethod: title: AWS CloudWatch Integration Authentication Method type: string readOnly: false enum: - ExternalId - SecurityToken example: ExternalId description: 'Indicates the mechanism used to authenticate with AWS. The allowed values are: "ExternalId": Expects you to supply an external ID and ARN for AWS "SecurityToken": Expects you to supply a key and token Note: For the GovCloud and China AWS regions, you can only use "AuthMethod": "SecurityToken"' collectOnlyRecommendedStats: title: AWS CloudWatch Integration Collect Only Recommended Stats Flag type: boolean default: false description: 'If set to true, Splunk Observability Cloud collects only a subset of statistics for metrics specified in the list of AWS recommended stats. If a metric is not on the recommended stats list, the integration collects the 5 default statistics: SampleCount (count in Splunk Observability Cloud), Average (mean), Sum (sum), Minimum (lower), and Maximum (upper).' customCloudWatchNamespaces: title: AWS CloudWatch Custom Namespace List type: string description: 'Comma-separated string list that contains custom AWS CloudWatch namespaces to monitor. These can be either custom namespaces you''ve created in AWS, or any namespace defined by AWS that Splunk Observability Cloud doesn''t support by default. To see the list of AWS services that Splunk Observability Cloud supports by default, see Supported AWS services in the Splunk Observability Cloud user documentation. Custom namespaces provide additional metrics. customCloudWatchNamespaces and customNamespaceSyncRules are similar but not equivalent: customCloudWatchNamespaces is list of namespaces, and customNamespaceSyncRules is an array of objects that specify a namespace and data collection rules for that namespace. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, the system ignores the value of customCloudWatchNamespaces. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' customNamespaceSyncRules: title: AWS CloudWatch Custom Namespace Sync Rule List type: array items: title: AWS CloudWatch Custom Namespace Sync Rule type: object properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: title: AWS CloudWatch Custom Namespace type: string description: 'Name of an AWS CloudWatch namespace you created to contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the AWS documentation for publishing metrics.' description: 'Specifies AWS namespaces you created, and the filters that Splunk Observability Cloud applies to data coming from from those namespaces.' description: 'List of custom AWS namespaces and filters, in the form of a JSON array of JSON objects. Each object specifies data collection rules for a single AWS namespace. Custom namespaces are namespaces you created. They contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the Amazon AWS documentation for publishing metrics. customNamespaceSyncRules and customCloudWatchNamespaces are similar but not equivalent: customNamespaceSyncRules is a list of objects that specify a namespace and data collection rules for that namespace, and customCloudWatchNamespaces is a list of namespaces. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, Splunk Observability Cloud ignores the customCloudWatchNamespaces property. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' enableAwsUsage: type: boolean example: true title: EnableAwsUsage description: 'Controls how Splunk Observability Cloud imports usage metrics from AWS to use with AWS Optimizer. If true, Splunk Observability Cloud imports the metrics.' enableCheckLargeVolume: title: AWS CloudWatch Large Data Volume Flag type: boolean example: true description: Controls how Splunk Observability Cloud checks for large amounts of data for this AWS integration. This check only runs once. If true, Splunk Observability Cloud monitors the amount of data coming in from the integration. If over 100,000 metrics are fetched, the integration is disabled. You can re-enable the integration afterwards. externalId: title: AWS CloudWatch Integration External ID type: string readOnly: true example: abcdefghijklmnopqrst description: 'If you specify "authMethod": "ExternalId" in your request to create an AWS integration object, the response object contains a value for externalId. Use this value and the ARN value you get from AWS to update the integration object. Splunk Observability Cloud can then connect to AWS using the integration object. Note: Splunk Observability Cloud sets this value, and you can''t change it.' ignoreAllStatusMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: 'true by default. When set to true, the following metrics are ignored: StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System. When set to false, only StatusCheckFailed is ignored.' importCloudWatch: title: Amazon CloudWatch Integration Metrics Import Flag type: boolean example: true description: 'Controls how Splunk Observability Cloud imports AWS CloudWatch metrics. If true, Splunk Observability Cloud imports Cloud Watch metrics from AWS.' includeEMRInstancesMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: false by default. If true, it syncs Elastic Map Reduce EC2 instance metrics. EC2 EMR instances are identified by the aws:elasticmapreduce:job-flow-id tag put on an instance. isLargeVolume: title: AWS CloudWatch Integration Receiving Large Volume Flag type: boolean example: false description: If true, it indicates that Splunk Observability Cloud is receiving over 100,000 metrics and tags from AWS. This property is read-only, and is only available if enableCheckLargeVolume is true. key: type: string format: password title: AWSKey description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the key.' metadataPollRate: title: Amazon CloudWatch Integration metadata poll rate type: integer format: int64 example: 900000 description: Specifies how often AWS metadata (tags and properties) are synchronized for the supported AWS services, in milliseconds. The default value is 15 minutes (900,000 ms), and can range from 1 minute to 1 hour. metricStatsToSync: title: Controls statistics per metric per namespace type: object additionalProperties: true example: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 description: 'A collection (associative array) of statistics to ingest for AWS metrics for AWS namespaces: Each primary key-value pair in the map specifies an AWS namespace name and a collection of metrics. Each key-value pair in the metrics collection specifies a metric name and an array of statistics. Considerations: The AWS namespace name can be up to 255 characters. It can''t start with a colon character (":"). The AWS metric name can be up to 255 characters. You can specify up to 10 statistics per metric. The API ignores blank, empty, or null statistics names. The API always returns the Splunk Observability Cloud form of a statistic name, regardless of its name in AWS. The statistics you can retrieve also depend on your use of AWS metric streams. For more information, see the Specify AWS statistics section in the Developer Guide for Splunk Observability Cloud.' metricStreamsSyncState: title: AWS CloudWatch Integration Metrics Streams Sync State type: string enum: - DISABLED - ENABLED - CANCELLING - CANCELLATION_FAILED example: ENABLED description: 'If set to ENABLED, enables AWS integration synchronization of Amazon CloudWatch Metrics Streams with Splunk Observability Cloud. The state indicator has four possible values: "DISABLED": Default. Only Splunk Observability Cloud can set the indicator to this value. Synchronization is disabled. "ENABLED"" Set this value to turn on synchronization. "CANCELLING": Set this value to turn off synchronization. This value triggers the cleanup procedure in your AWS account. The procedure deletes the AWS CloudWatch Metrics Streams objects in your account. Note: Change the state indicator to CANCELLING before you make any changes to the AWS policy that Splunk Observability Cloud uses. Splunk Observability Cloud still needs permissions set in the AWS policy in order to run the cleanup procedure. "CANCELLATION_FAILED": Returned by the API in the response body when the cleanup procedure failed. To retry the cancellation, change the value to "CANCELLING" and resend the request. The most common reason for a failed cancellation is a lack of required permissions. For example, if you first remove IAM permissions in AWS, you no longer have permission to run the cleanup procedure. Only Splunk Observability Cloud can set the indicator to this value. Note: CloudWatch Metric Streams doesn''t support filtering based on resource tags.' metricStreamsManagedExternally: type: boolean default: false example: true title: AWSMetricStreamsManagedExternally description: If set to true, Splunk Observability Cloud accepts data from Metric Streams managed from the AWS console. The AWS account sending the Metric Streams and the AWS account in the Splunk Observability Cloud integration have to match. namespacesExcludeTagSync: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' example: - AWS/ElasticBeanstalk - AWS/ElastiCache title: AWSNamespacesExcludeTagSync description: 'List of namespace names, defined by AWS, to exclude from tag metadata syncing. This property is similar to nameSpaceSyncRules, but namespacesExcludeTagSync excludes metadata rather than metrics for specific namespaces.' namespaceSyncRules: type: array minItems: 0 items: type: object required: - namespace properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNameSpaceSyncRule description: 'Namespace sync rule for a namespace defined by AWS. The rule contains the AWS namespace name and filter criteria. Splunk Observability Cloud applies the criteria to data coming in from the namespace.' title: AWSNameSpaceSyncRules description: 'List of AWS namespace sync rules. Each object contains a namespace name defined by AWS CloudWatch and filter criteria that Splunk Observability Cloud applies to data coming in from that namespace. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' prePauseState: type: string example: metricStreamsSyncState: ENABLED title: AWSPrePauseState description: Stores the integration's Metric Streams states previous to a change forced by modifying enabled. pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' inactiveMetricsPollRate: title: AWS CloudWatch Inactive Metrics Poll Rate type: integer format: int64 minimum: 60000 maximum: 3600000 example: 300000 description: 'Polling interval for AWS CloudWatch metrics that are not recently used. Splunk Observability Cloud applies this rate to metrics that have not been accessed by charts, detectors, or API queries within the recent usage window. The minimum value is 60000 ms (1 minute) and the maximum is 3600000 ms (60 minutes).' regions: type: array items: type: string enum: - ap-east-1 - ap-northeast-1 - ap-northeast-2 - ap-south-1 - ap-southeast-1 - ap-southeast-2 - ca-central-1 - eu-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - sa-east-1 - us-east-1 - us-east-2 - us-west-1 - us-west-2 example: - us-east-1 - us-east-2 - us-west-1 - us-west-2 title: AWSRegions description: 'List of AWS regions that you want Splunk Observability Cloud to monitor, in the form of a JSON array. See the list of AWS regions supported by Splunk Observability Cloud. If you omit the regions field or use "regions": [], the API adds all regular AWS regions to your integration. If you add the ec2:DescribeRegions permission to your AWS account, optional regions you''ve enabled on your AWS account will be enabled in Splunk Observability Cloud as well. If you want to enable a specific optional region, you need to do it before adding it to the integration. You can''t mix regions from different sets. For example, you can''t specify "regions": [ "eu-west-1", "cn-north-1"].' roleArn: type: string example: arn:aws:iam::123456789012:role/myIntegration title: AWSRoleArn description: 'Role ARN that you add to an existing AWS integration object. When you create an AWS integration object and specify "ExternalId" as the authentication method, Splunk Observability Cloud responds with an external ID. You provide this ID to AWS, which responds with a role ARN. To finish the connection between Splunk Observability Cloud and AWS, update the AWS integration object using a PUT request. In the request, specify roleArn property using the value you obtained from AWS. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNamespaceArray description: 'List of services, defined by AWS, for which you want Splunk Observability Cloud to collect data. This list refers to services by their AWS namespace names. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' sfxAwsAccountArn: title: Splunk Observability Cloud's AWS account ID description: Read-only. Specifies Splunk Observability Cloud's AWS account ID. It's used to establish a trust relationship with IAM when setting up IAM role used by the AWS integration. token: type: string format: password title: AWSToken description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the token.' syncCustomNamespacesOnly: type: boolean default: false example: true title: AWSSyncCustomNamespacesOnly description: Flag that controls the synchronization of metrics from custom AWS namespaces only. The default is false. If set to true, Splunk Observability Cloud only syncs metrics from custom AWS namespaces, and disregards metrics from built-in services. This is useful to limit data ingestion. syncLoadBalancerTargetGroupTags: type: boolean default: false example: true title: AWSSyncLoadBalancerTargetGroupTags description: 'This parameter is deprecated. Flag that controls the synchronization of Load Balancer Target group tags. If true, Splunk Observability Cloud syncs tags. The default is false. Note: To synchronize Load Balancer Target group tags, your AWS policy must include the permission elasticloadbalancing:DescribeTargetGroups. To learn more, see the Connect to AWS and send data to Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' required: - type - authMethod type: object description: 'Specifies the data collection integration between AWS CloudWatch and Splunk Observability Cloud, in the form of a JSON object.' - title: Amazon EventBridge Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' awsAccountId: title: Amazon EventBridge Integration Account ID type: string example: 123456789012 description: 'ID of the AWS account to use for the Amazon EventBridge integration. You get this value from AWS and send it to Splunk Observability Cloud when you create the integration.' eventSource: title: Amazon EventBridge Integration Event Source type: string example: aws.partner/buttercup.com/abcdefghijklmnopqrst description: 'String that identifies the Splunk Observability Cloud integration to Amazon EventBridge. Splunk Observability Cloud returns this string when you create the integration. The string has the format "/": "": Identifies Splunk Observability Cloud as the partner. Always aws.partner/observability.splunkcloud.com "": Splunk Observability Cloud event source identifier.' awsRegion: title: Amazon EventBridge Integration Region type: string example: ap-south-1 description: 'AWS region associated with the Amazon EventBridge integration. Each region that sends notifications needs its own integration. See the list of AWS regions supported by Splunk Observability Cloud.' type: type: string enum: - AmazonEventBridge example: AmazonEventBridge description: 'Type of service that this integration represents, in the form of an enumerated string, always "AmazonEventBridge".' required: - type type: object description: 'Specifies the properties of the integration between Amazon EventBridge and Splunk Observability Cloud, in the form of a JSON object' - title: Microsoft Azure Active Directory Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - AzureAD example: AzureAD description: 'Type of service that this integration represents, in the form of an enumerated string, always "AzureAD".' required: - type type: object description: 'Specifies the SAML integration between Azure Active Directory and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Azure Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' additionalServices: type: array items: type: string description: Name of a resource type to sync with Splunk Observability Cloud example: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices title: AzureAdditionalServices description: 'Additional Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. If you want to sync Azure resource types that Splunk Observability Cloud doesn''t fully support, add the types to the additionalServices array. The documentation for the services field contains a list of fully supported types. A resource type you specify in additionalServices must meet the following criteria: The type is a Azure GenericResource. For resource types that have hierarchical structure, only the root resource type is a GenericResource. For example, a Storage Account type can have a File Service type, and a File Service type can have a File Storage type. In this case, only Storage Account is a GenericResource. The resource type stores its metrics in Azure Monitor. To learn more about Azure Monitor, refer to the Microsoft Azure documentation. Splunk Observability Cloud syncs resource types that you specify in either services or additionalServices. If you add a resource type to both fields, Splunk Observability Cloud ignores the duplication.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' appId: type: string format: password title: AzureAppId description: 'Azure application ID for Splunk Observability Cloud. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' azureEnvironment: type: string enum: - AZURE - AZURE_US_GOVERNMENT example: AZURE title: AzureEnvironment description: 'Enumerated string that tells Splunk Observability Cloud what type of Azure integration this is. The allowed values are "AZURE_US_GOVERNMENT" and "AZURE". If you don''t specify a value in a POST request, Splunk Observability Cloud defaults to "AZURE".' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' secretKey: type: string format: password title: AzureSecretKey description: 'Azure secret key that associates Splunk Observability Cloud in Azure with the Azure tenant ID. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - microsoft.analysisservices/servers - microsoft.apimanagement/service - microsoft.automation/automationaccounts - microsoft.batch/batchaccounts - microsoft.cache/redis - microsoft.classiccompute/virtualmachines - microsoft.cognitiveservices/accounts - microsoft.compute/virtualmachines - microsoft.compute/virtualmachinescalesets - microsoft.compute/virtualmachinescalesets/virtualmachines - microsoft.containerinstance/containergroups - microsoft.containerservice/managedclusters - microsoft.customerinsights/hubs - microsoft.datafactory - microsoft.datafactory/datafactories - microsoft.datafactory/factories - microsoft.datalakeanalytics/accounts - microsoft.datalakestore/accounts - microsoft.dbformysql/servers - microsoft.dbforpostgresql/servers - microsoft.devices/elasticpools - microsoft.devices/elasticpools/iothubtenants - microsoft.devices/iothubs - microsoft.devices/provisioningservices - microsoft.documentdb/databaseaccounts - microsoft.eventhub/namespaces - microsoft.hdinsight/clusters - microsoft.keyvault/vaults - microsoft.locationbasedservices/accounts - microsoft.network/applicationgateways - microsoft.network/dnszones - microsoft.network/expressroutecircuits - microsoft.network/loadbalancers - microsoft.network/publicipaddresses - microsoft.network/trafficmanagerprofiles - microsoft.network/virtualnetworkgateways - microsoft.notificationhubs/namespaces/notificationhubs - microsoft.powerbidedicated/capacities - microsoft.relay/namespaces - microsoft.search/searchservices - microsoft.servicebus/namespaces - microsoft.sql/servers - microsoft.sql/servers/databases - microsoft.sql/servers/elasticpools - microsoft.storage/storageaccounts - microsoft.storage/storageaccounts/blobservices - microsoft.storage/storageaccounts/fileservices - microsoft.storage/storageaccounts/queueservices - microsoft.storage/storageaccounts/tableservices - microsoft.streamanalytics/streamingjobs - microsoft.web - microsoft.web/hostingenvironments/multirolepools - microsoft.web/hostingenvironments/workerpools - microsoft.web/serverfarms - microsoft.web/sites/slots example: - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs title: AzureServices description: 'List of Microsoft Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. Each element of services must be a resource type that Splunk Observability Cloud fully supports. The specification for array elements in services includes an enumerated list of fully supported types. To see the enumerated list of services, click the arrowhead to expand services, then click the arrowhead to expand ENUM. If you try to add a resource type that''s not in the enumerated list, Splunk Observability Cloud returns a 4xx HTTP response code. Even if the resource type isn''t listed, Splunk Observability Cloud might provide basic support for it. To learn more, see the documentation for the additionalServices field.' subscriptions: type: array items: type: string title: AzureSubscriptions description: 'List of Azure subscriptions that Splunk Observability Cloud should monitor, in the form of a JSON array of strings' resourceFilterRules: type: array items: type: object properties: filter: type: object properties: source: type: string example: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) description: Resource filter title: AzureResourceFilterRules description: 'List of rules to filter Azure resources by their tags. The source of each filter rule must be in the form filter(''key'', ''value''). You can join multiple filter statements using the and and or operators. Referenced keys are limited to tags and must be one of the following: tags prefixed with azure_tag_, or azure_resource_name, azure_resource_group_name or azure_kind.' tenantId: type: string example: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx title: AzureTenantId description: 'Azure ID of the Azure tenant. To learn how to get this ID, see the topic Prepare for Azure integration topic in the Splunk Observability Cloud user documentation.' useBatchApi: type: boolean title: AzureUseBatchApi description: false by default. If false, Splunk Observability Cloud uses the Azure Resource Manager Metrics List API to retrieve metrics. If useBatchApi is set to true, the Azure integration polls data using the Metrics Batch API (also known as the getBatch API or Data Plane API). Use this option to reduce observed throttling and latency. Note that Azure bills for requests to the Metrics Batch API. Refer to Azure documentation for more details. importAzureMonitor: type: boolean title: AzureImportAzureMonitor description: true by default. Controls how Splunk Observability Cloud imports Azure metrics. If set to false, metric sync is disabled, and only metadata is synced. type: type: string enum: - Azure example: Azure description: 'Type of service that this integration represents, in the form of an enumerated string, always "Azure".' syncGuestOsNamespaces: type: boolean example: true title: SyncGuestOsNamespaces description: 'Controls whether Splunk Observability Cloud syncs guest operating system (OS) namespaces. The default of false prevents Splunk Observability Cloud from retrieving metrics from guest OS namespace. Setting the field to true causes Splunk Observability Cloud to add metrics from the namespaces that the Azure Diagnostics extension recommends. These namespaces are are telegraf/mem, telegraf/cpu, and azure.vm.windows.guest. You can set syncGuestOsNamespaces to trueand specifycustomNamespacesPerService` at the same time.' customNamespacesPerService: type: object additionalProperties: type: string example: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace title: CustomNamespacesPerService description: 'Service-to-namespaces map that supports custom metrics for more fine-grained control of syncing. Default is empty. If you specify a map, Splunk Observability Cloud syncs metrics from namespaces in the map in addition to the default namespaces. The keys in customNamespacesPerService must be valid resource types. You can set syncGuestOsNamespaces to true and specify customNamespacesPerService at the same time.' required: - type type: object description: 'Specifies the data collection integration between Microsoft Azure and Splunk Observability Cloud, in the form of a JSON object.' - title: BigPanda Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' appKey: type: string format: password description: 'Application key you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' token: type: string format: password description: 'Token you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - BigPanda example: BigPanda description: 'Type of service that this integration represents, in the form of an enumerated string, always "BigPanda".' required: - type type: object description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Google Cloud Platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' customMetricTypeDomains: title: Custom GCP metrics list type: array example: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos items: type: string description: A single GCP service domain name you want to monitor. description: 'List of GCP service domain names that you want to monitor. Splunk Observability Cloud retrieves metrics from these service domains as well as the services you specify in the services field. If you specify an invalid service domain name, the system responds with an HTTP response code 400 and an error message. To learn more about the customMetricTypeDomains field, see the Custom metric type domains section in the Developer Guide for Splunk Observability Cloud.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' services: type: array items: type: string enum: - appengine - bigquery - bigtable - cloudfunctions - cloudiot - cloudsql - cloudtasks - compute - container - dataflow - datastore - firebasedatabase - firebasehosting - interconnect - loadbalancing - logging - ml - monitoring - pubsub - router - serviceruntime - spanner - storage - vpn example: - appengine - bigquery - bigtable title: GCPServices description: 'Array of GCP services that you want Splunk Observability Cloud to monitor. Splunk Observability Cloud only supports certain services, and if you specify an unsupported one, you receive an API error. The supported services are: "appengine" "bigquery" "bigtable" "cloudfunctions" "cloudiot" "cloudsql" "cloudtasks" "compute" "container" "dataflow" "datastore" "firebasedatabase" "firebasehosting" "interconnect" "loadbalancing" "logging" "ml" "monitoring" "pubsub" "router" "serviceruntime" "spanner" "storage" "vpn" To learn more, see the Connect to GCP topic in the Splunk Observability Cloud user documentation.' projects: title: GCPProjects type: object required: - selectedProjectIds properties: selectedProjectIds: type: array items: type: string example: - xxxxxx-yyyyyy-123456 description: A list of selected project ids. Use this only if syncMode is SELECTED. Only those projects will be synchronized. syncMode: type: string example: ALL_REACHABLE description: Valid values are ALL_REACHABLE or SELECTED. Mode of projects discovery ALL_REACHABLE - automatic synchronization of reachable projects. SELECTED - requires specifying a list of projects in selectedProjectIds. Only those projects will be synchronized. description: Project synchronization configuration. Allows you to choose synchronization mode - automatic synchronization or explicit list of projects. projectServiceKeys: type: array items: type: object required: - projectId - projectKey properties: projectId: type: string example: xxxxxx-yyyyyy-123456 description: GCP project ID you specified when you created your GCP project projectKey: type: string description: 'Contents of the GCP service account key file you generated when you created the project. Ensure that you escape special characters in this value before you you send it to Splunk Observability Cloud. Note: To ensure security, the API doesn''t return the value of this property in a response object.' title: GCPProjectServiceKey description: 'Properties of a GCP project, in the form of a JSON object. Contains the GCP project ID and GCP service account key for a GCP project that you want Splunk Observability Cloud to monitor.' title: GCPProjectServiceKeys description: 'List of GCP projects that you want Splunk Observability Cloud to monitor, in the form of a JSON array of objects' type: type: string enum: - GCP example: GCP description: 'Type of service that this integration represents, in the form of an enumerated string, always "GCP".' whitelist: deprecated: true description: DEPRECATED. Use includeList. includeList: type: array items: type: string minItems: 0 description: GCP metadata name example: - zone - labels - testkey1 - mywhitelist title: GCPIncludeList description: 'List of custom metadata keys that you want Splunk Observability Cloud to collect for GCP Compute Engine instances, in the form of a JSON array.' importGCPMetrics: type: boolean title: GCPImportGCPMetrics description: true by default. Controls how Splunk Observability Cloud imports GCP metrics. If set to false, metric sync is disabled, and only metadata is synced. useMetricSourceProjectForQuota: type: boolean items: type: boolean title: GCPUseMetricSourceProjectForQuota description: Set to true to use a quota from the project where metrics are stored. To use this, the project's service account requires a serviceusage.services.use permission, or you need a Service Usage Consumer role in the project. workloadIdentityFederationConfig: type: string title: GCPWorkloadIdentityFederationConfig description: Workload Identity Federation configuration exported from your account. Instructs Splunk Observability on how to authenticate to your GCP account. workloadIdentityFederationConfigs: deprecated: true type: array items: type: object title: GCPWorkloadIdentityFederationConfigs description: Pairs of projectId and wifConfig, where wifConfig is a Workload Identity Federation configuration. Deprecated. Use workloadIdentityFederationConfig and projects field instead. authMethod: type: string example: WORKLOAD_IDENTITY_FEDERATION title: GCPAuthMethod description: Authentication method. Valid values are WORKLOAD_IDENTITY_FEDERATION or SERVICE_ACCOUNT_KEY. If null it defaults to SERVICE_ACCOUNT_KEY wifSplunkIdentity: type: string readOnly: true example: service_account: splunk-observability@.iam.gserviceaccount.com title: GCPWifSplunkIdentity description: Splunk identity to use in Workload Identity Federation (WIF) attribute conditions and policy bindings excludeGCEInstancesWithLabels: title: GCP Compute Engine instance label exclusion list type: array items: type: string example: - goog-dataproc-cluster-uuid - custom-label description: 'List of label keys. GCP Compute Engine instances with any of these labels applied will be excluded from metric sync. To use this feature, the project''s service account requires a compute.instances.list permission. Note: You shall specify GCP labels as they appear in GCP without the gcp_label_ prefix.' required: - type type: object description: 'Specifies the data collection integration between Google Cloud Platform and Splunk Observability Cloud, in the form of a JSON object.' - title: Google Cloud Identity Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration type: type: string enum: - GoogleSaml example: GoogleSaml description: 'Type of service that this integration represents, in the form of an enumerated string, always "GoogleSaml".' required: - type type: object description: 'Specifies the SAML integration between Google Cloud Identity Integration Model and Splunk Observability Cloud, in the form of a JSON object.' - title: Jira Integration Response example: created: 1556728926015 creator: X_xxxxXXXXX enabled: true id: XXxxxXXXXXX name: Jira Cloud integration for warning notifications type: Jira assignee: name: mtwain displayName: Mark Twain authMethod: EmailAndToken baseUrl: https://www.buttercup.com issueType: Story projectKey: GEN userEmail: mtwain@example.com lastUpdated: 1557513720143 lastUpdatedBy: X_xxxx5XXXX username: null password: null apiToken: null properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' assignee: title: Jira ticket assignee type: object required: - name properties: name: title: Assignee user name type: string example: juser description: Jira user name for the assignee displayName: title: Assignee display name example: Jira User description: Jira display name for the assignee description: 'Username and optionally display name of the user to whom Jira assigns a new ticket for detector notifications. If you don''t specify this property when you create or update the integration, Splunk Observability Cloud uses the value of assignee from the detector that creates the alert notification. This lets you set a default assignee that individual detectors can override. If you don''t specify assignee for the integration or the detector, Jira uses its default value.' authMethod: title: Jira Integration Authentication Method type: string enum: - EmailAndToken - UsernameAndPassword example: EmailAndToken description: 'Authentication method to use when creating the Jira integration. The value must match the type of Jira instance you''re integrating with: Jira Cloud instance: "EmailAndToken" Jira Server instance: "UsernameAndPassword"' baseUrl: title: Jira Instance Base URL type: string format: url example: https://myjirainstance.atlassian.net description: 'Base URL of the Jira instance that''s integrated with Splunk Observability Cloud. The URL is supplied by Jira.' issueType: title: Jira issue type type: string example: Bug description: 'Issue type (for example, Story) for tickets that Jira creates for detector notifications Splunk Observability Cloud validates issue types, so you must specify a type that''s valid for the Jira project specified in projectKey.' projectKey: title: Jira Project Key type: string example: PRJ description: 'Jira key of an existing project. When Jira creates a new ticket for a detector notification, the ticket is assigned to this project.' type: type: string enum: - Jira example: Jira description: 'Type of service that this integration represents, in the form of an enumerated string, always "Jira".' apiToken: title: API token for Jira Cloud user email type: string example: x9X9XXXXxXXxxxxXxXxX9999 description: 'API token for the user email you use in authentication credentials for a Jira Cloud integration.' userEmail: title: Jira Cloud User Email type: string format: email example: user@mydomain.atlassian.net description: 'Email address used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' password: title: Jira Server User Password type: string format: password example: mypassword description: 'Password for the username used in Jira Server authentication credentials.' username: title: Jira Server User Name type: string example: myusername description: 'Username used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' required: - type type: object description: 'Properties returned from Splunk Observability Cloud when you create, retrieve or update an integration between Jira and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Teams Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' webhookUrl: title: Microsoft Teams Integration webhook URL type: string format: uri example: https://.webhook.office.com/webhook2/xxxxxxx description: 'Webhook URL provided by Microsoft Teams. When you create or update the integration, you must provide a Microsoft Teams URL known to Microsoft; otherwise, Microsoft rejects the request. To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - Office365 description: 'Type of service that this integration represents, in the form of an enumerated string. To ensure backward compatibility with previous versions of this integration, the type is "Office365".' required: - type type: object description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object.' - title: Okta Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - Okta example: Okta description: 'Type of service that this integration represents, in the form of an enumerated string, always "Okta".' required: - type type: object description: 'Specifies the SAML integration between Okta and Splunk Observability Cloud, in the form of a JSON object.' - title: OneLogin Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - OneLogin example: OneLogin description: 'Type of service that this integration represents, in the form of an enumerated string, always "OneLogin".' required: - type type: object description: 'Specifies the SAML integration between OneLogin and Splunk Observability Cloud, in the form of a JSON object.' - title: Opsgenie Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'An Opsgenie API key for sending alerts to an Opsgenie team or teams. Note: To ensure security, the API doesn''t return this property in response objects.' apiUrl: type: string format: url example: https://api.buttercup.com/ description: Your Opsgenie API URL type: type: string enum: - Opsgenie example: Opsgenie description: 'Type of service that this integration represents, in the form of an enumerated string, always "Opsgenie".' required: - apiKey - apiUrl - type type: object description: 'Specifies the properties of a notification service integration between Opsgenie and Splunk Observability Cloud, in the form of a JSON object' - title: PagerDuty Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'A key you get from PagerDuty that lets you integrate Splunk Observability Cloud with PagerDuty. PagerDuty refers to this property as the integrationKey. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - PagerDuty example: PagerDuty description: 'Type of service that this integration represents, in the form of an enumerated string, always "PagerDuty".' required: - type type: object description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object.' - title: PingOne Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' type: type: string enum: - PingOne example: PingOne description: 'Type of service that this integration represents, in the form of an enumerated string, always "PingOne".' required: - type type: object description: 'Specifies the SAML integration between PingOne and Splunk Observability Cloud, in the form of a JSON object.' - title: ServiceNow Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' instanceName: type: string example: anInstance.service-now.com description: 'ServiceNow instance name, for example myInstances.service-now.com. To learn more, see the Send alert notifications to ServiceNow using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' issueType: type: string enum: - Event - Incident - ImportSet - Problem example: Problem description: 'Type of issue, using standard ITIL terminology. This is an enumerated string that has the following possible values: Event Incident ImportSet Problem' username: type: string example: username description: 'Username you created in ServiceNow for the Splunk Observability Cloud integration. Note: In ServiceNow, you have to assign the roles web_service_admin and itil to this username.' password: type: string format: password description: 'Password associated with the username you created for this integration.' tableName: type: string example: u_incident_import description: Only applicable to integration instances with issueType of ImportSet value. Name of the custom table you created in ServiceNow. Splunk Observability Cloud sends requests to the specified table. type: type: string enum: - ServiceNow example: ServiceNow description: 'Type of service that this integration represents, in the form of an enumerated string, always "ServiceNow".' alertTriggeredPayloadTemplate: type: string example: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertResolvedPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow POST JSON payloads when an alert sends a notification to ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' alertResolvedPayloadTemplate: type: string example: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertTriggeredPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow PUT JSON payloads when an alert is cleared in ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' required: - type type: object description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - Webhook - OAuth example: OAuth description: 'Indicates the authentication method you want to use for integrating with the Slack API. This enumerated string has the following allowed values: Webhook OAuth' webhookUrl: type: string description: 'If you set "method": "Webhook", set "webhookUrl" to specify the incoming webhook URL. Note: To ensure security, the API doesn''t return this property in response objects.' scope: type: string description: 'If you set "method": "OAuth", set "scope" to specify the Slack OAuth scope string associated with this integration.' slackTeamName: type: string description: 'If you set "method": "OAuth", use "slackTeamName" to specify the name of the Slack team you''ve approved for this integration.' slackTeamId: type: string description: 'If you set the "method" property to "OAuth", use "slackTeamId" to specify the Slack ID for the Slack team you''ve approved for this integration.' slackUserId: type: string description: 'If you set the "method" property to "OAuth", use "slackUserId" to specify the Slack ID for the Slack user that approved this integration.' accessTokenUpdated: type: integer format: int64 example: 1555929030000 description: 'If you set the "method" property to "OAuth", "accessTokenUpdated" contains the last time that Slack refreshed or updated the access token. The value is in Unix time.' type: type: string enum: - Slack example: Slack description: 'Type of service that this integration represents, in the form of an enumerated string, always "Slack".' required: - type type: object description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk On-Call Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' postUrl: type: string description: 'Splunk On-Call API integration URL. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - VictorOps example: VictorOps description: 'Type of service that this integration represents, in the form of an enumerated string, always "VictorOps".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - SplunkPlatform example: SplunkPlatform description: 'Type of service that this integration represents, in the form of an enumerated string, always "SplunkPlatform"' url: type: string format: uri example: https://http-inputs-.splunkcloud.com description: Specify the HTTP Event Collector (HEC) URI for your Splunk platform instance. To learn more about HEC in Splunk platform, see the Send data to HTTP Event Collector section in the Documentation for Splunk Cloud Platform. hecToken: type: string example: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 description: 'HTTP Event Collector token that allows access to your Splunk platform instance. Splunk Observability Cloud doesn''t support HEC indexer acknowledgement. To use the Splunk platform integration, don''t activate indexer acknowledgement for HEC token in your Splunk Enterprise instance. Note: The value of hecToken isn''t returned in the response body.' payloadTemplate: type: string description: 'Customize the Splunk platform alert payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For the full list of supported variables, see the Supported variables for Splunk platform integration custom payload section in the Splunk Observability Cloud user documentation.' required: - type type: object description: Specifies the properties of a notification service integration between Splunk Observability Cloud and Splunk platform, in the form of a JSON object - title: Webhook Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - POST - PUT - GET example: POST default: POST description: HTTP method used to send webhook data. Valid methods include POST, PUT, and GET payloadTemplate: type: string example: severity: '{{{severity}}}' originatingMetric: '{{{originatingMetric}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' messageBody: '{{{encodeString messageBody}}}' src: '{{{src}}}' inputs: '{{{json inputs}}}' rule: '{{{encodeString rule}}}' description: '{{{encodeString description}}}' messageTitle: '{{{encodeString messageTitle}}}' sf_schema: '{{{sf_schema}}}' eventType: '{{{eventType}}}' runbookUrl: '{{{runbookUrl}}}' orgId: '{{{orgId}}}' detectorId: '{{{detectorId}}}' imageUrl: '{{{imageUrl}}}' tip: '{{{encodeString tip}}}' statusExtended: '{{{statusExtended}}}' incidentId: '{{{incidentId}}}' detector: '{{{encodeString detector}}}' detectorUrl: '{{{detectorUrl}}}' status: '{{{status}}}' timestamp: '{{{timestamp}}}' dimensions: '{{{json dimensions}}}' description: 'Customize the webhook payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For more information, see Webhook default payload. For the full list of supported variables, see the Integrate a webhook with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' url: type: string format: uri example: https://example.com/alarm/{{incidentId}}?status={{status}} description: Specify webhook's external site URL. You can use the Handlebars syntax for this URL. sharedSecret: type: string format: password description: 'Value that Splunk Observability Cloud uses as the secret cryptographic key in a message authentication code computation based on the HMAC-SHA256 algorithm. The Shared secret section in the Developer Guide for Splunk Observability Cloud describes the use sharedSecret in more detail. When you use sharedSecret, you need to know the steps Splunk Observability Cloud uses to compute the message authentication code, so you can perform the same computation and compare your results to a value you receive in the webhook request. sharedSecret is not returned in the response body.' headers: type: object example: Content-Type: application/json description: 'Associative array of HTTP headers and values, in the form of a JSON object. Splunk Observability Cloud adds the headers and values to HTTP requests sent to the webhook''s external site. When you provide a value for the payloadTemplate property, the headers property is used to determine expected payload type. When the headers property specifies "Content-Type" as "application/json" or "application/ld+json", Splunk Observability Cloud validates that the payload template produces a valid JSON objects. When no "Content-Type" is specified, Splunk Observability Cloud assumes you want to use a JSON payload and uses that validation.' type: type: string enum: - Webhook example: Webhook description: 'Type of service that this integration represents, in the form of an enumerated string, always "Webhook".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk Observability Cloud and an external site' - title: xMatters Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' url: type: string format: uri example: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' description: 'Webhook URL that connects the integration to your xMatters account. You get this URL from your xMatters account. To learn how, see the "SignalFx" topic in the "Integrations" section of the xMatters website.' type: type: string enum: - XMatters example: XMatters description: 'Type of service that this integration represents, in the form of an enumerated string, always "XMatters".' required: - type type: object description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' examples: Microsoft ADFS Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: ADFS AWS CloudWatch Integration: value: authMethod: ExternalId collectOnlyRecommendedStats: true created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customCloudWatchNamespaces: string customNamespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: string enableAwsUsage: true enableCheckLargeVolume: true enabled: true externalId: abcdefghijklmnopqrst id: XXxxxXXXXXX ignoreAllStatusMetrics: true importCloudWatch: true inactiveMetricsPollRate: 300000 includeEMRInstancesMetrics: true isLargeVolume: false key: string lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataPollRate: 900000 metricStatsToSync: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 metricStreamsManagedExternally: true metricStreamsSyncState: ENABLED name: MyIntegration namedToken: aCloudToken namespacesExcludeTagSync: - AWS/ElasticBeanstalk - AWS/ElastiCache namespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: AWS/DynamoDB pollRate: 60000 prePauseState: metricStreamsSyncState: ENABLED regions: - us-east-1 - us-east-2 - us-west-1 - us-west-2 roleArn: arn:aws:iam::123456789012:role/myIntegration services: - AWS/DynamoDB syncCustomNamespacesOnly: true syncLoadBalancerTargetGroupTags: true token: string type: AWSCloudWatch Amazon EventBridge Integration: value: awsAccountId: 123456789012 awsRegion: ap-south-1 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true eventSource: aws.partner/buttercup.com/abcdefghijklmnopqrst id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: AmazonEventBridge Microsoft Azure Active Directory Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: AzureAD Microsoft Azure Integration: value: additionalServices: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices appId: string azureEnvironment: AZURE created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customNamespacesPerService: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace enabled: true id: XXxxxXXXXXX importAzureMonitor: true lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 resourceFilterRules: - filter: source: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) secretKey: string services: - - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs subscriptions: - string syncGuestOsNamespaces: true tenantId: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx type: Azure useBatchApi: true BigPanda Integration: value: appKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration token: string type: BigPanda Google Cloud Platform Integration: value: authMethod: WORKLOAD_IDENTITY_FEDERATION created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customMetricTypeDomains: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos enabled: true excludeGCEInstancesWithLabels: - goog-dataproc-cluster-uuid - custom-label id: XXxxxXXXXXX importGCPMetrics: true includeList: - zone - labels - testkey1 - mywhitelist lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 projects: selectedProjectIds: - xxxxxx-yyyyyy-123456 syncMode: ALL_REACHABLE projectServiceKeys: - projectId: xxxxxx-yyyyyy-123456 projectKey: string services: - appengine - bigquery - bigtable type: GCP useMetricSourceProjectForQuota: true wifSplunkIdentity: service_account: splunk-observability@.iam.gserviceaccount.com workloadIdentityFederationConfig: string Google Cloud Identity Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: GoogleSaml Jira Integration Response: value: apiToken: null assignee: displayName: Mark Twain name: mtwain authMethod: EmailAndToken baseUrl: https://www.buttercup.com created: 1556728926015 creator: X_xxxxXXXXX enabled: true id: XXxxxXXXXXX issueType: Story lastUpdated: 1557513720143 lastUpdatedBy: X_xxxx5XXXX name: Jira Cloud integration for warning notifications password: null projectKey: GEN type: Jira userEmail: mtwain@example.com username: null Microsoft Teams Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Office365 webhookUrl: https://.webhook.office.com/webhook2/xxxxxxx Okta Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: Okta OneLogin Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: OneLogin Opsgenie Integration: value: apiKey: string apiUrl: https://api.buttercup.com/ created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Opsgenie PagerDuty Integration: value: apiKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: PagerDuty PingOne Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: PingOne ServiceNow Integration: value: alertResolvedPayloadTemplate: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' alertTriggeredPayloadTemplate: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX instanceName: anInstance.service-now.com issueType: Problem lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration password: string tableName: u_incident_import type: ServiceNow username: username Slack Integration: value: accessTokenUpdated: 1555929030000 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: OAuth name: MyIntegration scope: string slackTeamId: string slackTeamName: string slackUserId: string type: Slack webhookUrl: string Splunk On-Call Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration postUrl: string type: VictorOps Splunk platform Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true hecToken: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration payloadTemplate: string type: SplunkPlatform url: https://http-inputs-.splunkcloud.com Webhook Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true headers: Content-Type: application/json id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: POST name: MyIntegration payloadTemplate: description: '{{{encodeString description}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detector: '{{{encodeString detector}}}' detectorId: '{{{detectorId}}}' detectorUrl: '{{{detectorUrl}}}' dimensions: '{{{json dimensions}}}' eventType: '{{{eventType}}}' imageUrl: '{{{imageUrl}}}' incidentId: '{{{incidentId}}}' inputs: '{{{json inputs}}}' messageBody: '{{{encodeString messageBody}}}' messageTitle: '{{{encodeString messageTitle}}}' orgId: '{{{orgId}}}' originatingMetric: '{{{originatingMetric}}}' rule: '{{{encodeString rule}}}' runbookUrl: '{{{runbookUrl}}}' severity: '{{{severity}}}' sf_schema: '{{{sf_schema}}}' src: '{{{src}}}' status: '{{{status}}}' statusExtended: '{{{statusExtended}}}' timestamp: '{{{timestamp}}}' tip: '{{{encodeString tip}}}' sharedSecret: string type: Webhook url: https://example.com/alarm/{{incidentId}}?status={{status}} xMatters Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: XMatters url: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' security: - SessionToken: [] tags: - Integrations put: summary: Update Single Integration description: 'Updates the integration object specified by the id path parameter. Note: To ensure security, the API omits some authentication and authorization properties from response objects. Jira integration: For a Jira integration request, the response body contains a union of the following response properties: Properties common to all integration responses Properties common to all Jira integration responses Authentication credential properties for Jira Cloud integrations Authentication credential properties for Jira Server integrations Some Jira integration properties are set to null in the response: Optional properties that you didn''t specify in your creation request Password or API token, to ensure security Properties not used for a specific type of Jira integration. For example, if you integrate with Jira Cloud, the response body contains "username": null because username isn''t a valid property for a Jira Cloud integration.' parameters: - name: id in: path description: 'ID of the existing integration object that you want to update' required: true schema: type: string - name: skipValidation in: query description: 'Flag that controls how Splunk Observability Cloud validates an alert integration object. If true, Splunk Observability Cloud doesn''t send a test notification.' schema: type: boolean - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: 'Authentication token. Must be a session token (User API access token) associated with a user who has administrative privileges.' required: true schema: type: string requestBody: required: true content: application/json: schema: oneOf: - title: Microsoft ADFS Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - ADFS example: ADFS description: 'Type of service that this integration represents, in the form of an enumerated string, always "ADFS".' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration required: - type type: object description: 'Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.' - title: AWS CloudWatch Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' type: type: string enum: - AWSCloudWatch example: AWSCloudWatch description: 'Type of service that this integration represents, in the form of an enumerated string, always "AWSCloudWatch".' authMethod: title: AWS CloudWatch Integration Authentication Method type: string readOnly: false enum: - ExternalId - SecurityToken example: ExternalId description: 'Indicates the mechanism used to authenticate with AWS. The allowed values are: "ExternalId": Expects you to supply an external ID and ARN for AWS "SecurityToken": Expects you to supply a key and token Note: For the GovCloud and China AWS regions, you can only use "AuthMethod": "SecurityToken"' collectOnlyRecommendedStats: title: AWS CloudWatch Integration Collect Only Recommended Stats Flag type: boolean default: false description: 'If set to true, Splunk Observability Cloud collects only a subset of statistics for metrics specified in the list of AWS recommended stats. If a metric is not on the recommended stats list, the integration collects the 5 default statistics: SampleCount (count in Splunk Observability Cloud), Average (mean), Sum (sum), Minimum (lower), and Maximum (upper).' customCloudWatchNamespaces: title: AWS CloudWatch Custom Namespace List type: string description: 'Comma-separated string list that contains custom AWS CloudWatch namespaces to monitor. These can be either custom namespaces you''ve created in AWS, or any namespace defined by AWS that Splunk Observability Cloud doesn''t support by default. To see the list of AWS services that Splunk Observability Cloud supports by default, see Supported AWS services in the Splunk Observability Cloud user documentation. Custom namespaces provide additional metrics. customCloudWatchNamespaces and customNamespaceSyncRules are similar but not equivalent: customCloudWatchNamespaces is list of namespaces, and customNamespaceSyncRules is an array of objects that specify a namespace and data collection rules for that namespace. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, the system ignores the value of customCloudWatchNamespaces. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' customNamespaceSyncRules: title: AWS CloudWatch Custom Namespace Sync Rule List type: array items: title: AWS CloudWatch Custom Namespace Sync Rule type: object properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: title: AWS CloudWatch Custom Namespace type: string description: 'Name of an AWS CloudWatch namespace you created to contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the AWS documentation for publishing metrics.' description: 'Specifies AWS namespaces you created, and the filters that Splunk Observability Cloud applies to data coming from from those namespaces.' description: 'List of custom AWS namespaces and filters, in the form of a JSON array of JSON objects. Each object specifies data collection rules for a single AWS namespace. Custom namespaces are namespaces you created. They contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the Amazon AWS documentation for publishing metrics. customNamespaceSyncRules and customCloudWatchNamespaces are similar but not equivalent: customNamespaceSyncRules is a list of objects that specify a namespace and data collection rules for that namespace, and customCloudWatchNamespaces is a list of namespaces. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, Splunk Observability Cloud ignores the customCloudWatchNamespaces property. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' enableAwsUsage: type: boolean example: true title: EnableAwsUsage description: 'Controls how Splunk Observability Cloud imports usage metrics from AWS to use with AWS Optimizer. If true, Splunk Observability Cloud imports the metrics.' enableCheckLargeVolume: title: AWS CloudWatch Large Data Volume Flag type: boolean example: true description: Controls how Splunk Observability Cloud checks for large amounts of data for this AWS integration. This check only runs once. If true, Splunk Observability Cloud monitors the amount of data coming in from the integration. If over 100,000 metrics are fetched, the integration is disabled. You can re-enable the integration afterwards. externalId: title: AWS CloudWatch Integration External ID type: string readOnly: true example: abcdefghijklmnopqrst description: 'If you specify "authMethod": "ExternalId" in your request to create an AWS integration object, the response object contains a value for externalId. Use this value and the ARN value you get from AWS to update the integration object. Splunk Observability Cloud can then connect to AWS using the integration object. Note: Splunk Observability Cloud sets this value, and you can''t change it.' ignoreAllStatusMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: 'true by default. When set to true, the following metrics are ignored: StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System. When set to false, only StatusCheckFailed is ignored.' importCloudWatch: title: Amazon CloudWatch Integration Metrics Import Flag type: boolean example: true description: 'Controls how Splunk Observability Cloud imports AWS CloudWatch metrics. If true, Splunk Observability Cloud imports Cloud Watch metrics from AWS.' includeEMRInstancesMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: false by default. If true, it syncs Elastic Map Reduce EC2 instance metrics. EC2 EMR instances are identified by the aws:elasticmapreduce:job-flow-id tag put on an instance. isLargeVolume: title: AWS CloudWatch Integration Receiving Large Volume Flag type: boolean example: false description: If true, it indicates that Splunk Observability Cloud is receiving over 100,000 metrics and tags from AWS. This property is read-only, and is only available if enableCheckLargeVolume is true. key: type: string format: password title: AWSKey description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the key.' metadataPollRate: title: Amazon CloudWatch Integration metadata poll rate type: integer format: int64 example: 900000 description: Specifies how often AWS metadata (tags and properties) are synchronized for the supported AWS services, in milliseconds. The default value is 15 minutes (900,000 ms), and can range from 1 minute to 1 hour. metricStatsToSync: title: Controls statistics per metric per namespace type: object additionalProperties: true example: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 description: 'A collection (associative array) of statistics to ingest for AWS metrics for AWS namespaces: Each primary key-value pair in the map specifies an AWS namespace name and a collection of metrics. Each key-value pair in the metrics collection specifies a metric name and an array of statistics. Considerations: The AWS namespace name can be up to 255 characters. It can''t start with a colon character (":"). The AWS metric name can be up to 255 characters. You can specify up to 10 statistics per metric. The API ignores blank, empty, or null statistics names. The API always returns the Splunk Observability Cloud form of a statistic name, regardless of its name in AWS. The statistics you can retrieve also depend on your use of AWS metric streams. For more information, see the Specify AWS statistics section in the Developer Guide for Splunk Observability Cloud.' metricStreamsSyncState: title: AWS CloudWatch Integration Metrics Streams Sync State type: string enum: - DISABLED - ENABLED - CANCELLING - CANCELLATION_FAILED example: ENABLED description: 'If set to ENABLED, enables AWS integration synchronization of Amazon CloudWatch Metrics Streams with Splunk Observability Cloud. The state indicator has four possible values: "DISABLED": Default. Only Splunk Observability Cloud can set the indicator to this value. Synchronization is disabled. "ENABLED"" Set this value to turn on synchronization. "CANCELLING": Set this value to turn off synchronization. This value triggers the cleanup procedure in your AWS account. The procedure deletes the AWS CloudWatch Metrics Streams objects in your account. Note: Change the state indicator to CANCELLING before you make any changes to the AWS policy that Splunk Observability Cloud uses. Splunk Observability Cloud still needs permissions set in the AWS policy in order to run the cleanup procedure. "CANCELLATION_FAILED": Returned by the API in the response body when the cleanup procedure failed. To retry the cancellation, change the value to "CANCELLING" and resend the request. The most common reason for a failed cancellation is a lack of required permissions. For example, if you first remove IAM permissions in AWS, you no longer have permission to run the cleanup procedure. Only Splunk Observability Cloud can set the indicator to this value. Note: CloudWatch Metric Streams doesn''t support filtering based on resource tags.' metricStreamsManagedExternally: type: boolean default: false example: true title: AWSMetricStreamsManagedExternally description: If set to true, Splunk Observability Cloud accepts data from Metric Streams managed from the AWS console. The AWS account sending the Metric Streams and the AWS account in the Splunk Observability Cloud integration have to match. namespacesExcludeTagSync: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' example: - AWS/ElasticBeanstalk - AWS/ElastiCache title: AWSNamespacesExcludeTagSync description: 'List of namespace names, defined by AWS, to exclude from tag metadata syncing. This property is similar to nameSpaceSyncRules, but namespacesExcludeTagSync excludes metadata rather than metrics for specific namespaces.' namespaceSyncRules: type: array minItems: 0 items: type: object required: - namespace properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNameSpaceSyncRule description: 'Namespace sync rule for a namespace defined by AWS. The rule contains the AWS namespace name and filter criteria. Splunk Observability Cloud applies the criteria to data coming in from the namespace.' title: AWSNameSpaceSyncRules description: 'List of AWS namespace sync rules. Each object contains a namespace name defined by AWS CloudWatch and filter criteria that Splunk Observability Cloud applies to data coming in from that namespace. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' prePauseState: type: string example: metricStreamsSyncState: ENABLED title: AWSPrePauseState description: Stores the integration's Metric Streams states previous to a change forced by modifying enabled. pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' inactiveMetricsPollRate: title: AWS CloudWatch Inactive Metrics Poll Rate type: integer format: int64 minimum: 60000 maximum: 3600000 example: 300000 description: 'Polling interval for AWS CloudWatch metrics that are not recently used. Splunk Observability Cloud applies this rate to metrics that have not been accessed by charts, detectors, or API queries within the recent usage window. The minimum value is 60000 ms (1 minute) and the maximum is 3600000 ms (60 minutes).' regions: type: array items: type: string enum: - ap-east-1 - ap-northeast-1 - ap-northeast-2 - ap-south-1 - ap-southeast-1 - ap-southeast-2 - ca-central-1 - eu-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - sa-east-1 - us-east-1 - us-east-2 - us-west-1 - us-west-2 example: - us-east-1 - us-east-2 - us-west-1 - us-west-2 title: AWSRegions description: 'List of AWS regions that you want Splunk Observability Cloud to monitor, in the form of a JSON array. See the list of AWS regions supported by Splunk Observability Cloud. If you omit the regions field or use "regions": [], the API adds all regular AWS regions to your integration. If you add the ec2:DescribeRegions permission to your AWS account, optional regions you''ve enabled on your AWS account will be enabled in Splunk Observability Cloud as well. If you want to enable a specific optional region, you need to do it before adding it to the integration. You can''t mix regions from different sets. For example, you can''t specify "regions": [ "eu-west-1", "cn-north-1"].' roleArn: type: string example: arn:aws:iam::123456789012:role/myIntegration title: AWSRoleArn description: 'Role ARN that you add to an existing AWS integration object. When you create an AWS integration object and specify "ExternalId" as the authentication method, Splunk Observability Cloud responds with an external ID. You provide this ID to AWS, which responds with a role ARN. To finish the connection between Splunk Observability Cloud and AWS, update the AWS integration object using a PUT request. In the request, specify roleArn property using the value you obtained from AWS. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNamespaceArray description: 'List of services, defined by AWS, for which you want Splunk Observability Cloud to collect data. This list refers to services by their AWS namespace names. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' sfxAwsAccountArn: title: Splunk Observability Cloud's AWS account ID description: Read-only. Specifies Splunk Observability Cloud's AWS account ID. It's used to establish a trust relationship with IAM when setting up IAM role used by the AWS integration. token: type: string format: password title: AWSToken description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the token.' syncCustomNamespacesOnly: type: boolean default: false example: true title: AWSSyncCustomNamespacesOnly description: Flag that controls the synchronization of metrics from custom AWS namespaces only. The default is false. If set to true, Splunk Observability Cloud only syncs metrics from custom AWS namespaces, and disregards metrics from built-in services. This is useful to limit data ingestion. syncLoadBalancerTargetGroupTags: type: boolean default: false example: true title: AWSSyncLoadBalancerTargetGroupTags description: 'This parameter is deprecated. Flag that controls the synchronization of Load Balancer Target group tags. If true, Splunk Observability Cloud syncs tags. The default is false. Note: To synchronize Load Balancer Target group tags, your AWS policy must include the permission elasticloadbalancing:DescribeTargetGroups. To learn more, see the Connect to AWS and send data to Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' required: - type - authMethod type: object description: 'Specifies the data collection integration between AWS CloudWatch and Splunk Observability Cloud, in the form of a JSON object.' - title: Amazon EventBridge Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' awsAccountId: title: Amazon EventBridge Integration Account ID type: string example: 123456789012 description: 'ID of the AWS account to use for the Amazon EventBridge integration. You get this value from AWS and send it to Splunk Observability Cloud when you create the integration.' eventSource: title: Amazon EventBridge Integration Event Source type: string example: aws.partner/buttercup.com/abcdefghijklmnopqrst description: 'String that identifies the Splunk Observability Cloud integration to Amazon EventBridge. Splunk Observability Cloud returns this string when you create the integration. The string has the format "/": "": Identifies Splunk Observability Cloud as the partner. Always aws.partner/observability.splunkcloud.com "": Splunk Observability Cloud event source identifier.' awsRegion: title: Amazon EventBridge Integration Region type: string example: ap-south-1 description: 'AWS region associated with the Amazon EventBridge integration. Each region that sends notifications needs its own integration. See the list of AWS regions supported by Splunk Observability Cloud.' type: type: string enum: - AmazonEventBridge example: AmazonEventBridge description: 'Type of service that this integration represents, in the form of an enumerated string, always "AmazonEventBridge".' required: - type type: object description: 'Specifies the properties of the integration between Amazon EventBridge and Splunk Observability Cloud, in the form of a JSON object' - title: Microsoft Azure Active Directory Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - AzureAD example: AzureAD description: 'Type of service that this integration represents, in the form of an enumerated string, always "AzureAD".' required: - type type: object description: 'Specifies the SAML integration between Azure Active Directory and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Azure Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' additionalServices: type: array items: type: string description: Name of a resource type to sync with Splunk Observability Cloud example: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices title: AzureAdditionalServices description: 'Additional Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. If you want to sync Azure resource types that Splunk Observability Cloud doesn''t fully support, add the types to the additionalServices array. The documentation for the services field contains a list of fully supported types. A resource type you specify in additionalServices must meet the following criteria: The type is a Azure GenericResource. For resource types that have hierarchical structure, only the root resource type is a GenericResource. For example, a Storage Account type can have a File Service type, and a File Service type can have a File Storage type. In this case, only Storage Account is a GenericResource. The resource type stores its metrics in Azure Monitor. To learn more about Azure Monitor, refer to the Microsoft Azure documentation. Splunk Observability Cloud syncs resource types that you specify in either services or additionalServices. If you add a resource type to both fields, Splunk Observability Cloud ignores the duplication.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' appId: type: string format: password title: AzureAppId description: 'Azure application ID for Splunk Observability Cloud. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' azureEnvironment: type: string enum: - AZURE - AZURE_US_GOVERNMENT example: AZURE title: AzureEnvironment description: 'Enumerated string that tells Splunk Observability Cloud what type of Azure integration this is. The allowed values are "AZURE_US_GOVERNMENT" and "AZURE". If you don''t specify a value in a POST request, Splunk Observability Cloud defaults to "AZURE".' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' secretKey: type: string format: password title: AzureSecretKey description: 'Azure secret key that associates Splunk Observability Cloud in Azure with the Azure tenant ID. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - microsoft.analysisservices/servers - microsoft.apimanagement/service - microsoft.automation/automationaccounts - microsoft.batch/batchaccounts - microsoft.cache/redis - microsoft.classiccompute/virtualmachines - microsoft.cognitiveservices/accounts - microsoft.compute/virtualmachines - microsoft.compute/virtualmachinescalesets - microsoft.compute/virtualmachinescalesets/virtualmachines - microsoft.containerinstance/containergroups - microsoft.containerservice/managedclusters - microsoft.customerinsights/hubs - microsoft.datafactory - microsoft.datafactory/datafactories - microsoft.datafactory/factories - microsoft.datalakeanalytics/accounts - microsoft.datalakestore/accounts - microsoft.dbformysql/servers - microsoft.dbforpostgresql/servers - microsoft.devices/elasticpools - microsoft.devices/elasticpools/iothubtenants - microsoft.devices/iothubs - microsoft.devices/provisioningservices - microsoft.documentdb/databaseaccounts - microsoft.eventhub/namespaces - microsoft.hdinsight/clusters - microsoft.keyvault/vaults - microsoft.locationbasedservices/accounts - microsoft.network/applicationgateways - microsoft.network/dnszones - microsoft.network/expressroutecircuits - microsoft.network/loadbalancers - microsoft.network/publicipaddresses - microsoft.network/trafficmanagerprofiles - microsoft.network/virtualnetworkgateways - microsoft.notificationhubs/namespaces/notificationhubs - microsoft.powerbidedicated/capacities - microsoft.relay/namespaces - microsoft.search/searchservices - microsoft.servicebus/namespaces - microsoft.sql/servers - microsoft.sql/servers/databases - microsoft.sql/servers/elasticpools - microsoft.storage/storageaccounts - microsoft.storage/storageaccounts/blobservices - microsoft.storage/storageaccounts/fileservices - microsoft.storage/storageaccounts/queueservices - microsoft.storage/storageaccounts/tableservices - microsoft.streamanalytics/streamingjobs - microsoft.web - microsoft.web/hostingenvironments/multirolepools - microsoft.web/hostingenvironments/workerpools - microsoft.web/serverfarms - microsoft.web/sites/slots example: - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs title: AzureServices description: 'List of Microsoft Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. Each element of services must be a resource type that Splunk Observability Cloud fully supports. The specification for array elements in services includes an enumerated list of fully supported types. To see the enumerated list of services, click the arrowhead to expand services, then click the arrowhead to expand ENUM. If you try to add a resource type that''s not in the enumerated list, Splunk Observability Cloud returns a 4xx HTTP response code. Even if the resource type isn''t listed, Splunk Observability Cloud might provide basic support for it. To learn more, see the documentation for the additionalServices field.' subscriptions: type: array items: type: string title: AzureSubscriptions description: 'List of Azure subscriptions that Splunk Observability Cloud should monitor, in the form of a JSON array of strings' resourceFilterRules: type: array items: type: object properties: filter: type: object properties: source: type: string example: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) description: Resource filter title: AzureResourceFilterRules description: 'List of rules to filter Azure resources by their tags. The source of each filter rule must be in the form filter(''key'', ''value''). You can join multiple filter statements using the and and or operators. Referenced keys are limited to tags and must be one of the following: tags prefixed with azure_tag_, or azure_resource_name, azure_resource_group_name or azure_kind.' tenantId: type: string example: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx title: AzureTenantId description: 'Azure ID of the Azure tenant. To learn how to get this ID, see the topic Prepare for Azure integration topic in the Splunk Observability Cloud user documentation.' useBatchApi: type: boolean title: AzureUseBatchApi description: false by default. If false, Splunk Observability Cloud uses the Azure Resource Manager Metrics List API to retrieve metrics. If useBatchApi is set to true, the Azure integration polls data using the Metrics Batch API (also known as the getBatch API or Data Plane API). Use this option to reduce observed throttling and latency. Note that Azure bills for requests to the Metrics Batch API. Refer to Azure documentation for more details. importAzureMonitor: type: boolean title: AzureImportAzureMonitor description: true by default. Controls how Splunk Observability Cloud imports Azure metrics. If set to false, metric sync is disabled, and only metadata is synced. type: type: string enum: - Azure example: Azure description: 'Type of service that this integration represents, in the form of an enumerated string, always "Azure".' syncGuestOsNamespaces: type: boolean example: true title: SyncGuestOsNamespaces description: 'Controls whether Splunk Observability Cloud syncs guest operating system (OS) namespaces. The default of false prevents Splunk Observability Cloud from retrieving metrics from guest OS namespace. Setting the field to true causes Splunk Observability Cloud to add metrics from the namespaces that the Azure Diagnostics extension recommends. These namespaces are are telegraf/mem, telegraf/cpu, and azure.vm.windows.guest. You can set syncGuestOsNamespaces to trueand specifycustomNamespacesPerService` at the same time.' customNamespacesPerService: type: object additionalProperties: type: string example: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace title: CustomNamespacesPerService description: 'Service-to-namespaces map that supports custom metrics for more fine-grained control of syncing. Default is empty. If you specify a map, Splunk Observability Cloud syncs metrics from namespaces in the map in addition to the default namespaces. The keys in customNamespacesPerService must be valid resource types. You can set syncGuestOsNamespaces to true and specify customNamespacesPerService at the same time.' required: - type type: object description: 'Specifies the data collection integration between Microsoft Azure and Splunk Observability Cloud, in the form of a JSON object.' - title: BigPanda Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' appKey: type: string format: password description: 'Application key you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' token: type: string format: password description: 'Token you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - BigPanda example: BigPanda description: 'Type of service that this integration represents, in the form of an enumerated string, always "BigPanda".' required: - type type: object description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Google Cloud Platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' customMetricTypeDomains: title: Custom GCP metrics list type: array example: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos items: type: string description: A single GCP service domain name you want to monitor. description: 'List of GCP service domain names that you want to monitor. Splunk Observability Cloud retrieves metrics from these service domains as well as the services you specify in the services field. If you specify an invalid service domain name, the system responds with an HTTP response code 400 and an error message. To learn more about the customMetricTypeDomains field, see the Custom metric type domains section in the Developer Guide for Splunk Observability Cloud.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' services: type: array items: type: string enum: - appengine - bigquery - bigtable - cloudfunctions - cloudiot - cloudsql - cloudtasks - compute - container - dataflow - datastore - firebasedatabase - firebasehosting - interconnect - loadbalancing - logging - ml - monitoring - pubsub - router - serviceruntime - spanner - storage - vpn example: - appengine - bigquery - bigtable title: GCPServices description: 'Array of GCP services that you want Splunk Observability Cloud to monitor. Splunk Observability Cloud only supports certain services, and if you specify an unsupported one, you receive an API error. The supported services are: "appengine" "bigquery" "bigtable" "cloudfunctions" "cloudiot" "cloudsql" "cloudtasks" "compute" "container" "dataflow" "datastore" "firebasedatabase" "firebasehosting" "interconnect" "loadbalancing" "logging" "ml" "monitoring" "pubsub" "router" "serviceruntime" "spanner" "storage" "vpn" To learn more, see the Connect to GCP topic in the Splunk Observability Cloud user documentation.' projects: title: GCPProjects type: object required: - selectedProjectIds properties: selectedProjectIds: type: array items: type: string example: - xxxxxx-yyyyyy-123456 description: A list of selected project ids. Use this only if syncMode is SELECTED. Only those projects will be synchronized. syncMode: type: string example: ALL_REACHABLE description: Valid values are ALL_REACHABLE or SELECTED. Mode of projects discovery ALL_REACHABLE - automatic synchronization of reachable projects. SELECTED - requires specifying a list of projects in selectedProjectIds. Only those projects will be synchronized. description: Project synchronization configuration. Allows you to choose synchronization mode - automatic synchronization or explicit list of projects. projectServiceKeys: type: array items: type: object required: - projectId - projectKey properties: projectId: type: string example: xxxxxx-yyyyyy-123456 description: GCP project ID you specified when you created your GCP project projectKey: type: string description: 'Contents of the GCP service account key file you generated when you created the project. Ensure that you escape special characters in this value before you you send it to Splunk Observability Cloud. Note: To ensure security, the API doesn''t return the value of this property in a response object.' title: GCPProjectServiceKey description: 'Properties of a GCP project, in the form of a JSON object. Contains the GCP project ID and GCP service account key for a GCP project that you want Splunk Observability Cloud to monitor.' title: GCPProjectServiceKeys description: 'List of GCP projects that you want Splunk Observability Cloud to monitor, in the form of a JSON array of objects' type: type: string enum: - GCP example: GCP description: 'Type of service that this integration represents, in the form of an enumerated string, always "GCP".' whitelist: deprecated: true description: DEPRECATED. Use includeList. includeList: type: array items: type: string minItems: 0 description: GCP metadata name example: - zone - labels - testkey1 - mywhitelist title: GCPIncludeList description: 'List of custom metadata keys that you want Splunk Observability Cloud to collect for GCP Compute Engine instances, in the form of a JSON array.' importGCPMetrics: type: boolean title: GCPImportGCPMetrics description: true by default. Controls how Splunk Observability Cloud imports GCP metrics. If set to false, metric sync is disabled, and only metadata is synced. useMetricSourceProjectForQuota: type: boolean items: type: boolean title: GCPUseMetricSourceProjectForQuota description: Set to true to use a quota from the project where metrics are stored. To use this, the project's service account requires a serviceusage.services.use permission, or you need a Service Usage Consumer role in the project. workloadIdentityFederationConfig: type: string title: GCPWorkloadIdentityFederationConfig description: Workload Identity Federation configuration exported from your account. Instructs Splunk Observability on how to authenticate to your GCP account. workloadIdentityFederationConfigs: deprecated: true type: array items: type: object title: GCPWorkloadIdentityFederationConfigs description: Pairs of projectId and wifConfig, where wifConfig is a Workload Identity Federation configuration. Deprecated. Use workloadIdentityFederationConfig and projects field instead. authMethod: type: string example: WORKLOAD_IDENTITY_FEDERATION title: GCPAuthMethod description: Authentication method. Valid values are WORKLOAD_IDENTITY_FEDERATION or SERVICE_ACCOUNT_KEY. If null it defaults to SERVICE_ACCOUNT_KEY wifSplunkIdentity: type: string readOnly: true example: service_account: splunk-observability@.iam.gserviceaccount.com title: GCPWifSplunkIdentity description: Splunk identity to use in Workload Identity Federation (WIF) attribute conditions and policy bindings excludeGCEInstancesWithLabels: title: GCP Compute Engine instance label exclusion list type: array items: type: string example: - goog-dataproc-cluster-uuid - custom-label description: 'List of label keys. GCP Compute Engine instances with any of these labels applied will be excluded from metric sync. To use this feature, the project''s service account requires a compute.instances.list permission. Note: You shall specify GCP labels as they appear in GCP without the gcp_label_ prefix.' required: - type type: object description: 'Specifies the data collection integration between Google Cloud Platform and Splunk Observability Cloud, in the form of a JSON object.' - title: Google Cloud Identity Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration type: type: string enum: - GoogleSaml example: GoogleSaml description: 'Type of service that this integration represents, in the form of an enumerated string, always "GoogleSaml".' required: - type type: object description: 'Specifies the SAML integration between Google Cloud Identity Integration Model and Splunk Observability Cloud, in the form of a JSON object.' - title: Jira Integration Request oneOf: - title: Jira Cloud Integration type: object required: - apiToken - userEmail properties: apiToken: title: API token for Jira Cloud user email type: string example: x9X9XXXXxXXxxxxXxXxX9999 description: 'API token for the user email you use in authentication credentials for a Jira Cloud integration.' userEmail: title: Jira Cloud User Email type: string format: email example: user@mydomain.atlassian.net description: 'Email address used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' description: Specific properties for integrating a Jira Cloud instance with Splunk Observability Cloud. - title: Jira Server Integration type: object required: - password - username properties: password: title: Jira Server User Password type: string format: password example: mypassword description: 'Password for the username used in Jira Server authentication credentials.' username: title: Jira Server User Name type: string example: myusername description: 'Username used to authenticate the Jira integration. The associated Jira user must have the following project permissions: Create issues Add comments Browse projects' description: Specific properties for integrating a Jira Server instance with Splunk Observability Cloud. example: enabled: true name: Jira Cloud integration for warning notifications type: Jira assignee: name: mtwain displayName: Mark Twain authMethod: EmailAndToken baseUrl: https://mycompany.buttercup.com issueType: Story projectKey: GEN userEmail: mtwain@example.com apiToken: x9X9XXXXxXXxxxxXxXxX9999 properties: enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' assignee: title: Jira ticket assignee type: object required: - name properties: name: title: Assignee user name type: string example: juser description: Jira user name for the assignee displayName: title: Assignee display name example: Jira User description: Jira display name for the assignee description: 'Username and optionally display name of the user to whom Jira assigns a new ticket for detector notifications. If you don''t specify this property when you create or update the integration, Splunk Observability Cloud uses the value of assignee from the detector that creates the alert notification. This lets you set a default assignee that individual detectors can override. If you don''t specify assignee for the integration or the detector, Jira uses its default value.' authMethod: title: Jira Integration Authentication Method type: string enum: - EmailAndToken - UsernameAndPassword example: EmailAndToken description: 'Authentication method to use when creating the Jira integration. The value must match the type of Jira instance you''re integrating with: Jira Cloud instance: "EmailAndToken" Jira Server instance: "UsernameAndPassword"' baseUrl: title: Jira Instance Base URL type: string format: url example: https://myjirainstance.atlassian.net description: 'Base URL of the Jira instance that''s integrated with Splunk Observability Cloud. The URL is supplied by Jira.' issueType: title: Jira issue type type: string example: Bug description: 'Issue type (for example, Story) for tickets that Jira creates for detector notifications Splunk Observability Cloud validates issue types, so you must specify a type that''s valid for the Jira project specified in projectKey.' projectKey: title: Jira Project Key type: string example: PRJ description: 'Jira key of an existing project. When Jira creates a new ticket for a detector notification, the ticket is assigned to this project.' type: type: string enum: - Jira example: Jira description: 'Type of service that this integration represents, in the form of an enumerated string, always "Jira".' required: - authMethod - baseUrl - issueType - projectKey - type type: object description: 'Set of properties used to create or update a Jira integration, in the form of a JSON object. This set includes properties common to all integrations and properties common to all Jira requests. Choose Jira Cloud Integration to view the properties for an integration with a Jira Cloud instance. Choose Jira Server Integration to view the properties for an integration with a Jira Server instance.' - title: Microsoft Teams Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' webhookUrl: title: Microsoft Teams Integration webhook URL type: string format: uri example: https://.webhook.office.com/webhook2/xxxxxxx description: 'Webhook URL provided by Microsoft Teams. When you create or update the integration, you must provide a Microsoft Teams URL known to Microsoft; otherwise, Microsoft rejects the request. To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - Office365 description: 'Type of service that this integration represents, in the form of an enumerated string. To ensure backward compatibility with previous versions of this integration, the type is "Office365".' required: - type type: object description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object.' - title: Okta Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - Okta example: Okta description: 'Type of service that this integration represents, in the form of an enumerated string, always "Okta".' required: - type type: object description: 'Specifies the SAML integration between Okta and Splunk Observability Cloud, in the form of a JSON object.' - title: OneLogin Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - OneLogin example: OneLogin description: 'Type of service that this integration represents, in the form of an enumerated string, always "OneLogin".' required: - type type: object description: 'Specifies the SAML integration between OneLogin and Splunk Observability Cloud, in the form of a JSON object.' - title: Opsgenie Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'An Opsgenie API key for sending alerts to an Opsgenie team or teams. Note: To ensure security, the API doesn''t return this property in response objects.' apiUrl: type: string format: url example: https://api.buttercup.com/ description: Your Opsgenie API URL type: type: string enum: - Opsgenie example: Opsgenie description: 'Type of service that this integration represents, in the form of an enumerated string, always "Opsgenie".' required: - apiKey - apiUrl - type type: object description: 'Specifies the properties of a notification service integration between Opsgenie and Splunk Observability Cloud, in the form of a JSON object' - title: PagerDuty Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'A key you get from PagerDuty that lets you integrate Splunk Observability Cloud with PagerDuty. PagerDuty refers to this property as the integrationKey. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - PagerDuty example: PagerDuty description: 'Type of service that this integration represents, in the form of an enumerated string, always "PagerDuty".' required: - type type: object description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object.' - title: PingOne Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' type: type: string enum: - PingOne example: PingOne description: 'Type of service that this integration represents, in the form of an enumerated string, always "PingOne".' required: - type type: object description: 'Specifies the SAML integration between PingOne and Splunk Observability Cloud, in the form of a JSON object.' - title: ServiceNow Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' instanceName: type: string example: anInstance.service-now.com description: 'ServiceNow instance name, for example myInstances.service-now.com. To learn more, see the Send alert notifications to ServiceNow using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' issueType: type: string enum: - Event - Incident - ImportSet - Problem example: Problem description: 'Type of issue, using standard ITIL terminology. This is an enumerated string that has the following possible values: Event Incident ImportSet Problem' username: type: string example: username description: 'Username you created in ServiceNow for the Splunk Observability Cloud integration. Note: In ServiceNow, you have to assign the roles web_service_admin and itil to this username.' password: type: string format: password description: 'Password associated with the username you created for this integration.' tableName: type: string example: u_incident_import description: Only applicable to integration instances with issueType of ImportSet value. Name of the custom table you created in ServiceNow. Splunk Observability Cloud sends requests to the specified table. type: type: string enum: - ServiceNow example: ServiceNow description: 'Type of service that this integration represents, in the form of an enumerated string, always "ServiceNow".' alertTriggeredPayloadTemplate: type: string example: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertResolvedPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow POST JSON payloads when an alert sends a notification to ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' alertResolvedPayloadTemplate: type: string example: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertTriggeredPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow PUT JSON payloads when an alert is cleared in ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' required: - type type: object description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - Webhook - OAuth example: OAuth description: 'Indicates the authentication method you want to use for integrating with the Slack API. This enumerated string has the following allowed values: Webhook OAuth' webhookUrl: type: string description: 'If you set "method": "Webhook", set "webhookUrl" to specify the incoming webhook URL. Note: To ensure security, the API doesn''t return this property in response objects.' scope: type: string description: 'If you set "method": "OAuth", set "scope" to specify the Slack OAuth scope string associated with this integration.' slackTeamName: type: string description: 'If you set "method": "OAuth", use "slackTeamName" to specify the name of the Slack team you''ve approved for this integration.' slackTeamId: type: string description: 'If you set the "method" property to "OAuth", use "slackTeamId" to specify the Slack ID for the Slack team you''ve approved for this integration.' slackUserId: type: string description: 'If you set the "method" property to "OAuth", use "slackUserId" to specify the Slack ID for the Slack user that approved this integration.' accessTokenUpdated: type: integer format: int64 example: 1555929030000 description: 'If you set the "method" property to "OAuth", "accessTokenUpdated" contains the last time that Slack refreshed or updated the access token. The value is in Unix time.' type: type: string enum: - Slack example: Slack description: 'Type of service that this integration represents, in the form of an enumerated string, always "Slack".' required: - type type: object description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk On-Call Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' postUrl: type: string description: 'Splunk On-Call API integration URL. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - VictorOps example: VictorOps description: 'Type of service that this integration represents, in the form of an enumerated string, always "VictorOps".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - SplunkPlatform example: SplunkPlatform description: 'Type of service that this integration represents, in the form of an enumerated string, always "SplunkPlatform"' url: type: string format: uri example: https://http-inputs-.splunkcloud.com description: Specify the HTTP Event Collector (HEC) URI for your Splunk platform instance. To learn more about HEC in Splunk platform, see the Send data to HTTP Event Collector section in the Documentation for Splunk Cloud Platform. hecToken: type: string example: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 description: 'HTTP Event Collector token that allows access to your Splunk platform instance. Splunk Observability Cloud doesn''t support HEC indexer acknowledgement. To use the Splunk platform integration, don''t activate indexer acknowledgement for HEC token in your Splunk Enterprise instance. Note: The value of hecToken isn''t returned in the response body.' payloadTemplate: type: string description: 'Customize the Splunk platform alert payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For the full list of supported variables, see the Supported variables for Splunk platform integration custom payload section in the Splunk Observability Cloud user documentation.' required: - type type: object description: Specifies the properties of a notification service integration between Splunk Observability Cloud and Splunk platform, in the form of a JSON object - title: Webhook Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - POST - PUT - GET example: POST default: POST description: HTTP method used to send webhook data. Valid methods include POST, PUT, and GET payloadTemplate: type: string example: severity: '{{{severity}}}' originatingMetric: '{{{originatingMetric}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' messageBody: '{{{encodeString messageBody}}}' src: '{{{src}}}' inputs: '{{{json inputs}}}' rule: '{{{encodeString rule}}}' description: '{{{encodeString description}}}' messageTitle: '{{{encodeString messageTitle}}}' sf_schema: '{{{sf_schema}}}' eventType: '{{{eventType}}}' runbookUrl: '{{{runbookUrl}}}' orgId: '{{{orgId}}}' detectorId: '{{{detectorId}}}' imageUrl: '{{{imageUrl}}}' tip: '{{{encodeString tip}}}' statusExtended: '{{{statusExtended}}}' incidentId: '{{{incidentId}}}' detector: '{{{encodeString detector}}}' detectorUrl: '{{{detectorUrl}}}' status: '{{{status}}}' timestamp: '{{{timestamp}}}' dimensions: '{{{json dimensions}}}' description: 'Customize the webhook payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For more information, see Webhook default payload. For the full list of supported variables, see the Integrate a webhook with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' url: type: string format: uri example: https://example.com/alarm/{{incidentId}}?status={{status}} description: Specify webhook's external site URL. You can use the Handlebars syntax for this URL. sharedSecret: type: string format: password description: 'Value that Splunk Observability Cloud uses as the secret cryptographic key in a message authentication code computation based on the HMAC-SHA256 algorithm. The Shared secret section in the Developer Guide for Splunk Observability Cloud describes the use sharedSecret in more detail. When you use sharedSecret, you need to know the steps Splunk Observability Cloud uses to compute the message authentication code, so you can perform the same computation and compare your results to a value you receive in the webhook request. sharedSecret is not returned in the response body.' headers: type: object example: Content-Type: application/json description: 'Associative array of HTTP headers and values, in the form of a JSON object. Splunk Observability Cloud adds the headers and values to HTTP requests sent to the webhook''s external site. When you provide a value for the payloadTemplate property, the headers property is used to determine expected payload type. When the headers property specifies "Content-Type" as "application/json" or "application/ld+json", Splunk Observability Cloud validates that the payload template produces a valid JSON objects. When no "Content-Type" is specified, Splunk Observability Cloud assumes you want to use a JSON payload and uses that validation.' type: type: string enum: - Webhook example: Webhook description: 'Type of service that this integration represents, in the form of an enumerated string, always "Webhook".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk Observability Cloud and an external site' - title: xMatters Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' url: type: string format: uri example: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' description: 'Webhook URL that connects the integration to your xMatters account. You get this URL from your xMatters account. To learn how, see the "SignalFx" topic in the "Integrations" section of the xMatters website.' type: type: string enum: - XMatters example: XMatters description: 'Type of service that this integration represents, in the form of an enumerated string, always "XMatters".' required: - type type: object description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' examples: Microsoft ADFS Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: ADFS AWS CloudWatch Integration: value: authMethod: ExternalId collectOnlyRecommendedStats: true created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customCloudWatchNamespaces: string customNamespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: string enableAwsUsage: true enableCheckLargeVolume: true enabled: true externalId: abcdefghijklmnopqrst id: XXxxxXXXXXX ignoreAllStatusMetrics: true importCloudWatch: true inactiveMetricsPollRate: 300000 includeEMRInstancesMetrics: true isLargeVolume: false key: string lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataPollRate: 900000 metricStatsToSync: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 metricStreamsManagedExternally: true metricStreamsSyncState: ENABLED name: MyIntegration namedToken: aCloudToken namespacesExcludeTagSync: - AWS/ElasticBeanstalk - AWS/ElastiCache namespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: AWS/DynamoDB pollRate: 60000 prePauseState: metricStreamsSyncState: ENABLED regions: - us-east-1 - us-east-2 - us-west-1 - us-west-2 roleArn: arn:aws:iam::123456789012:role/myIntegration services: - AWS/DynamoDB syncCustomNamespacesOnly: true syncLoadBalancerTargetGroupTags: true token: string type: AWSCloudWatch Amazon EventBridge Integration: value: awsAccountId: 123456789012 awsRegion: ap-south-1 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true eventSource: aws.partner/buttercup.com/abcdefghijklmnopqrst id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: AmazonEventBridge Microsoft Azure Active Directory Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: AzureAD Microsoft Azure Integration: value: additionalServices: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices appId: string azureEnvironment: AZURE created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customNamespacesPerService: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace enabled: true id: XXxxxXXXXXX importAzureMonitor: true lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 resourceFilterRules: - filter: source: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) secretKey: string services: - - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs subscriptions: - string syncGuestOsNamespaces: true tenantId: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx type: Azure useBatchApi: true BigPanda Integration: value: appKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration token: string type: BigPanda Google Cloud Platform Integration: value: authMethod: WORKLOAD_IDENTITY_FEDERATION created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customMetricTypeDomains: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos enabled: true excludeGCEInstancesWithLabels: - goog-dataproc-cluster-uuid - custom-label id: XXxxxXXXXXX importGCPMetrics: true includeList: - zone - labels - testkey1 - mywhitelist lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 projects: selectedProjectIds: - xxxxxx-yyyyyy-123456 syncMode: ALL_REACHABLE projectServiceKeys: - projectId: xxxxxx-yyyyyy-123456 projectKey: string services: - appengine - bigquery - bigtable type: GCP useMetricSourceProjectForQuota: true wifSplunkIdentity: service_account: splunk-observability@.iam.gserviceaccount.com workloadIdentityFederationConfig: string Google Cloud Identity Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: GoogleSaml Jira Integration Request: value: apiToken: x9X9XXXXxXXxxxxXxXxX9999 assignee: displayName: Mark Twain name: mtwain authMethod: EmailAndToken baseUrl: https://mycompany.buttercup.com enabled: true issueType: Story name: Jira Cloud integration for warning notifications projectKey: GEN type: Jira userEmail: mtwain@example.com Microsoft Teams Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Office365 webhookUrl: https://.webhook.office.com/webhook2/xxxxxxx Okta Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: Okta OneLogin Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: OneLogin Opsgenie Integration: value: apiKey: string apiUrl: https://api.buttercup.com/ created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Opsgenie PagerDuty Integration: value: apiKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: PagerDuty PingOne Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: PingOne ServiceNow Integration: value: alertResolvedPayloadTemplate: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' alertTriggeredPayloadTemplate: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX instanceName: anInstance.service-now.com issueType: Problem lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration password: string tableName: u_incident_import type: ServiceNow username: username Slack Integration: value: accessTokenUpdated: 1555929030000 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: OAuth name: MyIntegration scope: string slackTeamId: string slackTeamName: string slackUserId: string type: Slack webhookUrl: string Splunk On-Call Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration postUrl: string type: VictorOps Splunk platform Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true hecToken: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration payloadTemplate: string type: SplunkPlatform url: https://http-inputs-.splunkcloud.com Webhook Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true headers: Content-Type: application/json id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: POST name: MyIntegration payloadTemplate: description: '{{{encodeString description}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detector: '{{{encodeString detector}}}' detectorId: '{{{detectorId}}}' detectorUrl: '{{{detectorUrl}}}' dimensions: '{{{json dimensions}}}' eventType: '{{{eventType}}}' imageUrl: '{{{imageUrl}}}' incidentId: '{{{incidentId}}}' inputs: '{{{json inputs}}}' messageBody: '{{{encodeString messageBody}}}' messageTitle: '{{{encodeString messageTitle}}}' orgId: '{{{orgId}}}' originatingMetric: '{{{originatingMetric}}}' rule: '{{{encodeString rule}}}' runbookUrl: '{{{runbookUrl}}}' severity: '{{{severity}}}' sf_schema: '{{{sf_schema}}}' src: '{{{src}}}' status: '{{{status}}}' statusExtended: '{{{statusExtended}}}' timestamp: '{{{timestamp}}}' tip: '{{{encodeString tip}}}' sharedSecret: string type: Webhook url: https://example.com/alarm/{{incidentId}}?status={{status}} xMatters Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: XMatters url: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' responses: '200': description: HTTP 200 response content: application/json: schema: oneOf: - title: Microsoft ADFS Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - ADFS example: ADFS description: 'Type of service that this integration represents, in the form of an enumerated string, always "ADFS".' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration required: - type type: object description: 'Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.' - title: AWS CloudWatch Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' type: type: string enum: - AWSCloudWatch example: AWSCloudWatch description: 'Type of service that this integration represents, in the form of an enumerated string, always "AWSCloudWatch".' authMethod: title: AWS CloudWatch Integration Authentication Method type: string readOnly: false enum: - ExternalId - SecurityToken example: ExternalId description: 'Indicates the mechanism used to authenticate with AWS. The allowed values are: "ExternalId": Expects you to supply an external ID and ARN for AWS "SecurityToken": Expects you to supply a key and token Note: For the GovCloud and China AWS regions, you can only use "AuthMethod": "SecurityToken"' collectOnlyRecommendedStats: title: AWS CloudWatch Integration Collect Only Recommended Stats Flag type: boolean default: false description: 'If set to true, Splunk Observability Cloud collects only a subset of statistics for metrics specified in the list of AWS recommended stats. If a metric is not on the recommended stats list, the integration collects the 5 default statistics: SampleCount (count in Splunk Observability Cloud), Average (mean), Sum (sum), Minimum (lower), and Maximum (upper).' customCloudWatchNamespaces: title: AWS CloudWatch Custom Namespace List type: string description: 'Comma-separated string list that contains custom AWS CloudWatch namespaces to monitor. These can be either custom namespaces you''ve created in AWS, or any namespace defined by AWS that Splunk Observability Cloud doesn''t support by default. To see the list of AWS services that Splunk Observability Cloud supports by default, see Supported AWS services in the Splunk Observability Cloud user documentation. Custom namespaces provide additional metrics. customCloudWatchNamespaces and customNamespaceSyncRules are similar but not equivalent: customCloudWatchNamespaces is list of namespaces, and customNamespaceSyncRules is an array of objects that specify a namespace and data collection rules for that namespace. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, the system ignores the value of customCloudWatchNamespaces. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' customNamespaceSyncRules: title: AWS CloudWatch Custom Namespace Sync Rule List type: array items: title: AWS CloudWatch Custom Namespace Sync Rule type: object properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: title: AWS CloudWatch Custom Namespace type: string description: 'Name of an AWS CloudWatch namespace you created to contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the AWS documentation for publishing metrics.' description: 'Specifies AWS namespaces you created, and the filters that Splunk Observability Cloud applies to data coming from from those namespaces.' description: 'List of custom AWS namespaces and filters, in the form of a JSON array of JSON objects. Each object specifies data collection rules for a single AWS namespace. Custom namespaces are namespaces you created. They contain custom metrics that you defined in AWS. Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more, see the Amazon AWS documentation for publishing metrics. customNamespaceSyncRules and customCloudWatchNamespaces are similar but not equivalent: customNamespaceSyncRules is a list of objects that specify a namespace and data collection rules for that namespace, and customCloudWatchNamespaces is a list of namespaces. customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules for the namespace. If you specify customNamespaceSyncRules, Splunk Observability Cloud ignores the customCloudWatchNamespaces property. To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' enableAwsUsage: type: boolean example: true title: EnableAwsUsage description: 'Controls how Splunk Observability Cloud imports usage metrics from AWS to use with AWS Optimizer. If true, Splunk Observability Cloud imports the metrics.' enableCheckLargeVolume: title: AWS CloudWatch Large Data Volume Flag type: boolean example: true description: Controls how Splunk Observability Cloud checks for large amounts of data for this AWS integration. This check only runs once. If true, Splunk Observability Cloud monitors the amount of data coming in from the integration. If over 100,000 metrics are fetched, the integration is disabled. You can re-enable the integration afterwards. externalId: title: AWS CloudWatch Integration External ID type: string readOnly: true example: abcdefghijklmnopqrst description: 'If you specify "authMethod": "ExternalId" in your request to create an AWS integration object, the response object contains a value for externalId. Use this value and the ARN value you get from AWS to update the integration object. Splunk Observability Cloud can then connect to AWS using the integration object. Note: Splunk Observability Cloud sets this value, and you can''t change it.' ignoreAllStatusMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: 'true by default. When set to true, the following metrics are ignored: StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System. When set to false, only StatusCheckFailed is ignored.' importCloudWatch: title: Amazon CloudWatch Integration Metrics Import Flag type: boolean example: true description: 'Controls how Splunk Observability Cloud imports AWS CloudWatch metrics. If true, Splunk Observability Cloud imports Cloud Watch metrics from AWS.' includeEMRInstancesMetrics: title: Amazon CloudWatch Integration Ignores status metrics type: boolean example: true description: false by default. If true, it syncs Elastic Map Reduce EC2 instance metrics. EC2 EMR instances are identified by the aws:elasticmapreduce:job-flow-id tag put on an instance. isLargeVolume: title: AWS CloudWatch Integration Receiving Large Volume Flag type: boolean example: false description: If true, it indicates that Splunk Observability Cloud is receiving over 100,000 metrics and tags from AWS. This property is read-only, and is only available if enableCheckLargeVolume is true. key: type: string format: password title: AWSKey description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the key.' metadataPollRate: title: Amazon CloudWatch Integration metadata poll rate type: integer format: int64 example: 900000 description: Specifies how often AWS metadata (tags and properties) are synchronized for the supported AWS services, in milliseconds. The default value is 15 minutes (900,000 ms), and can range from 1 minute to 1 hour. metricStatsToSync: title: Controls statistics per metric per namespace type: object additionalProperties: true example: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 description: 'A collection (associative array) of statistics to ingest for AWS metrics for AWS namespaces: Each primary key-value pair in the map specifies an AWS namespace name and a collection of metrics. Each key-value pair in the metrics collection specifies a metric name and an array of statistics. Considerations: The AWS namespace name can be up to 255 characters. It can''t start with a colon character (":"). The AWS metric name can be up to 255 characters. You can specify up to 10 statistics per metric. The API ignores blank, empty, or null statistics names. The API always returns the Splunk Observability Cloud form of a statistic name, regardless of its name in AWS. The statistics you can retrieve also depend on your use of AWS metric streams. For more information, see the Specify AWS statistics section in the Developer Guide for Splunk Observability Cloud.' metricStreamsSyncState: title: AWS CloudWatch Integration Metrics Streams Sync State type: string enum: - DISABLED - ENABLED - CANCELLING - CANCELLATION_FAILED example: ENABLED description: 'If set to ENABLED, enables AWS integration synchronization of Amazon CloudWatch Metrics Streams with Splunk Observability Cloud. The state indicator has four possible values: "DISABLED": Default. Only Splunk Observability Cloud can set the indicator to this value. Synchronization is disabled. "ENABLED"" Set this value to turn on synchronization. "CANCELLING": Set this value to turn off synchronization. This value triggers the cleanup procedure in your AWS account. The procedure deletes the AWS CloudWatch Metrics Streams objects in your account. Note: Change the state indicator to CANCELLING before you make any changes to the AWS policy that Splunk Observability Cloud uses. Splunk Observability Cloud still needs permissions set in the AWS policy in order to run the cleanup procedure. "CANCELLATION_FAILED": Returned by the API in the response body when the cleanup procedure failed. To retry the cancellation, change the value to "CANCELLING" and resend the request. The most common reason for a failed cancellation is a lack of required permissions. For example, if you first remove IAM permissions in AWS, you no longer have permission to run the cleanup procedure. Only Splunk Observability Cloud can set the indicator to this value. Note: CloudWatch Metric Streams doesn''t support filtering based on resource tags.' metricStreamsManagedExternally: type: boolean default: false example: true title: AWSMetricStreamsManagedExternally description: If set to true, Splunk Observability Cloud accepts data from Metric Streams managed from the AWS console. The AWS account sending the Metric Streams and the AWS account in the Splunk Observability Cloud integration have to match. namespacesExcludeTagSync: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' example: - AWS/ElasticBeanstalk - AWS/ElastiCache title: AWSNamespacesExcludeTagSync description: 'List of namespace names, defined by AWS, to exclude from tag metadata syncing. This property is similar to nameSpaceSyncRules, but namespacesExcludeTagSync excludes metadata rather than metrics for specific namespaces.' namespaceSyncRules: type: array minItems: 0 items: type: object required: - namespace properties: defaultAction: title: AWS CloudWatch Integration Default Action type: string enum: - Exclude - Include example: Exclude description: 'Controls Splunk Observability Cloud default behavior when ingesting data from an AWS namespace. Splunk Observability Cloud ignores this property unless you specify the filter property in the namespace sync rule. When you specify a filter, use this property to control how Splunk Observability Cloud treats data that doesn''t match the filter, using the following values: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it' filter: type: object properties: action: type: string enum: - Exclude - Include example: Include title: AWSSyncRuleFilterAction description: 'Controls how Splunk Observability Cloud processes data from a custom AWS namespace. The available actions are: "Exclude": Don''t sync data from the namespace unless a filter includes it "Include": Sync the data from the name namespace unless a filter excludes it Note: Use action in conjunction with defaultAction to control data collection from the custom namespace. Set action as the opposite of defaultAction. Although Splunk Observability Cloud accepts the same value for action and defaultAction, the resulting filter will ingest all incoming data.' source: title: AWSSyncRuleFilterSource description: 'Expression that selects the data that Splunk Observability Cloud should sync for the custom namespace associated with this sync rule. The expression uses the syntax defined for the SignalFlow filter() function; it can be any valid SignalFlow filter expression. Notes: Splunk Observability Cloud can only display a subset of filter() options in the native, interactive AWS integration UI. The options that Splunk Observability Cloud can''t display are still visible in the SignalFlow expression for the filter, but you can''t edit them. To modify these options, use the the API to modify the expression. To refer to AWS metrics in a filter() expression, preface the metric name with the string sf_metric. The metric value doesn''t need a preface. See Integrate AWS monitoring with Splunk Observability Cloud for more information. To refer to AWS tags in a filter() expression, preface the tag name with the string aws_tag_. The tag value doesn''t need a preface. Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can only filter on a tag when it comes from an AWS namespace (service) for which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t synced, the entire filter expression returns false, and you don''t receive any data. To see a list of the AWS namespaces (services) for which Infrastructure Monitoring syncs tags, refer to the Synced tags and properties topic in the Splunk Observability Cloud user documentation.' title: AWSSyncRuleFilter description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS namespace. This gives you more fine-grained control over the incoming data. If you don''t specify a filter, Splunk Observability Cloud brings in all the data from the namespace.' namespace: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNameSpaceSyncRule description: 'Namespace sync rule for a namespace defined by AWS. The rule contains the AWS namespace name and filter criteria. Splunk Observability Cloud applies the criteria to data coming in from the namespace.' title: AWSNameSpaceSyncRules description: 'List of AWS namespace sync rules. Each object contains a namespace name defined by AWS CloudWatch and filter criteria that Splunk Observability Cloud applies to data coming in from that namespace. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' prePauseState: type: string example: metricStreamsSyncState: ENABLED title: AWSPrePauseState description: Stores the integration's Metric Streams states previous to a change forced by modifying enabled. pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' inactiveMetricsPollRate: title: AWS CloudWatch Inactive Metrics Poll Rate type: integer format: int64 minimum: 60000 maximum: 3600000 example: 300000 description: 'Polling interval for AWS CloudWatch metrics that are not recently used. Splunk Observability Cloud applies this rate to metrics that have not been accessed by charts, detectors, or API queries within the recent usage window. The minimum value is 60000 ms (1 minute) and the maximum is 3600000 ms (60 minutes).' regions: type: array items: type: string enum: - ap-east-1 - ap-northeast-1 - ap-northeast-2 - ap-south-1 - ap-southeast-1 - ap-southeast-2 - ca-central-1 - eu-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - sa-east-1 - us-east-1 - us-east-2 - us-west-1 - us-west-2 example: - us-east-1 - us-east-2 - us-west-1 - us-west-2 title: AWSRegions description: 'List of AWS regions that you want Splunk Observability Cloud to monitor, in the form of a JSON array. See the list of AWS regions supported by Splunk Observability Cloud. If you omit the regions field or use "regions": [], the API adds all regular AWS regions to your integration. If you add the ec2:DescribeRegions permission to your AWS account, optional regions you''ve enabled on your AWS account will be enabled in Splunk Observability Cloud as well. If you want to enable a specific optional region, you need to do it before adding it to the integration. You can''t mix regions from different sets. For example, you can''t specify "regions": [ "eu-west-1", "cn-north-1"].' roleArn: type: string example: arn:aws:iam::123456789012:role/myIntegration title: AWSRoleArn description: 'Role ARN that you add to an existing AWS integration object. When you create an AWS integration object and specify "ExternalId" as the authentication method, Splunk Observability Cloud responds with an external ID. You provide this ID to AWS, which responds with a role ARN. To finish the connection between Splunk Observability Cloud and AWS, update the AWS integration object using a PUT request. In the request, specify roleArn property using the value you obtained from AWS. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - AWS/ACMPrivateCA - AWS/AmazonMQ - AWS/ApiGateway - AWS/ApplicationELB - AWS/AppStream - AWS/Athena - AWS/AutoScaling - AWS/Backup - AWS/Billing - AWS/CertificateManager - AWS/CloudFront - AWS/CloudHSM - AWS/CloudSearch - AWS/CodeBuild - AWS/Cognito - AWS/Connect - AWS/DDoSProtection - AWS/DMS - AWS/DocDB - AWS/DX - AWS/DynamoDB - AWS/EBS - AWS/EC2 - AWS/EC2Spot - AWS/ECS - AWS/EFS - AWS/EKS - AWS/ElasticBeanstalk - AWS/ElastiCache - AWS/ElasticInterface - AWS/ElasticMapReduce - AWS/ElasticTranscoder - AWS/ELB - AWS/ES - AWS/Events - AWS/Firehose - AWS/FSx - AWS/GameLift - Glue - AWS/Inspector - AWS/IoT - AWS/IoTAnalytics - AWS/Kafka - AWS/Kinesis - AWS/KinesisAnalytics - AWS/KinesisVideo - AWS/KMS - AWS/Lambda - AWS/Lex - AWS/Logs - AWS/MediaConnect - AWS/MediaConvert - MediaLive - AWS/MediaPackage - AWS/MediaTailor - AWS/ML - AWS/NATGateway - AWS/Neptune - AWS/NetworkELB - AWS/OpsWorks - AWS/Polly - AWS/Redshift - AWS/RDS - AWS/Robomaker - AWS/Route53 - AWS/SageMaker - aws/sagemaker/Endpoints - aws/sagemaker/TrainingJobs - aws/sagemaker/TransformJobs - AWS/SDKMetrics - AWS/SES - AWS/SNS - AWS/SQS - AWS/S3 - AWS/S3/Storage-Lens - AWS/SWF - AWS/States - AWS/StorageGateway - System/Linux - AWS/Textract - AWS/ThingsGraph - AWS/TrustedAdvisor - AWS/Translate - AWS/VPN (VPN) - WAF - AWS/WAFV2 - AWS/WorkSpaces - CWAgent example: AWS/DynamoDB title: AWSNamespace description: 'AWS namespace name for the AWS service from which you want to collect data. Splunk Observability Cloud supports the following namespaces defined by AWS: "AWS/ACMPrivateCA" "AWS/AmazonMQ" "AWS/ApiGateway" "AWS/ApplicationELB" "AWS/AppStream" "AWS/Athena" "AWS/AutoScaling" "AWS/Backup" "AWS/Billing" "AWS/CertificateManager" "AWS/CloudFront" "AWS/CloudHSM" "AWS/CloudSearch" "AWS/CodeBuild" "AWS/Cognito" "AWS/Connect" "AWS/DDoSProtection" "AWS/DMS" "AWS/DocDB" "AWS/DX" "AWS/DynamoDB" "AWS/EBS" "AWS/EC2" "AWS/EC2Spot" "AWS/ECS" "AWS/EFS" "AWS/EKS" "AWS/ElasticBeanstalk" "AWS/ElastiCache" "AWS/ElasticInterface" "AWS/ElasticMapReduce" "AWS/ElasticTranscoder" "AWS/ELB" "AWS/ES" "AWS/Events" "AWS/Firehose" "AWS/FSx" "AWS/GameLift" "Glue" "AWS/Inspector" "AWS/IoT" "AWS/IoTAnalytics" "AWS/Kafka" "AWS/Kinesis" "AWS/KinesisAnalytics" "AWS/KinesisVideo" "AWS/KMS" "AWS/Lambda" "AWS/Lex" "AWS/Logs" "AWS/MediaConnect" "AWS/MediaConvert" "MediaLive" "AWS/MediaPackage" "AWS/MediaTailor" "AWS/ML" "AWS/NATGateway" "AWS/Neptune" "AWS/NetworkELB" "AWS/OpsWorks" "AWS/Polly" "AWS/Redshift" "AWS/RDS" "AWS/Robomaker" "AWS/Route53" "AWS/SageMaker" "aws/sagemaker/Endpoints" "aws/sagemaker/TrainingJobs" "aws/sagemaker/TransformJobs" "aws/SDKMetrics" "AWS/SES" "AWS/SNS" "AWS/SQS" "AWS/S3" "AWS/S3/Storage-Lens" "AWS/SWF" "AWS/States" "AWS/StorageGateway" "System/Linux" "AWS/Textract" "AWS/ThingsGraph" "AWS/TrustedAdvisor" "AWS/Translate" "AWS/VPN (VPN)" "WAF" (AWS WAF Classic) "AWS/WAFV2" (AWS WAF V2) "AWS/WorkSpaces" "CWAgent" CloudWatch agent (In previous releases, the CloudWatch agent used the System/Linux namespace. Splunk Observability Cloud now supports both System/Linux and CWAgent.)' title: AWSNamespaceArray description: 'List of services, defined by AWS, for which you want Splunk Observability Cloud to collect data. This list refers to services by their AWS namespace names. By default, Splunk Observability Cloud supports the services listed in Supported AWS services. To collect data from any other namespace, specify it in customCloudWatchNamespaces or customNamespaceSyncRules. Note that namespaceSyncRules overrides the AWS namespaces specified in services.' sfxAwsAccountArn: title: Splunk Observability Cloud's AWS account ID description: Read-only. Specifies Splunk Observability Cloud's AWS account ID. It's used to establish a trust relationship with IAM when setting up IAM role used by the AWS integration. token: type: string format: password title: AWSToken description: 'If you specify "authMethod": "SecurityToken" in your request to create an AWS integration object, use this property to specify the token.' syncCustomNamespacesOnly: type: boolean default: false example: true title: AWSSyncCustomNamespacesOnly description: Flag that controls the synchronization of metrics from custom AWS namespaces only. The default is false. If set to true, Splunk Observability Cloud only syncs metrics from custom AWS namespaces, and disregards metrics from built-in services. This is useful to limit data ingestion. syncLoadBalancerTargetGroupTags: type: boolean default: false example: true title: AWSSyncLoadBalancerTargetGroupTags description: 'This parameter is deprecated. Flag that controls the synchronization of Load Balancer Target group tags. If true, Splunk Observability Cloud syncs tags. The default is false. Note: To synchronize Load Balancer Target group tags, your AWS policy must include the permission elasticloadbalancing:DescribeTargetGroups. To learn more, see the Connect to AWS and send data to Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' required: - type - authMethod type: object description: 'Specifies the data collection integration between AWS CloudWatch and Splunk Observability Cloud, in the form of a JSON object.' - title: Amazon EventBridge Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' awsAccountId: title: Amazon EventBridge Integration Account ID type: string example: 123456789012 description: 'ID of the AWS account to use for the Amazon EventBridge integration. You get this value from AWS and send it to Splunk Observability Cloud when you create the integration.' eventSource: title: Amazon EventBridge Integration Event Source type: string example: aws.partner/buttercup.com/abcdefghijklmnopqrst description: 'String that identifies the Splunk Observability Cloud integration to Amazon EventBridge. Splunk Observability Cloud returns this string when you create the integration. The string has the format "/": "": Identifies Splunk Observability Cloud as the partner. Always aws.partner/observability.splunkcloud.com "": Splunk Observability Cloud event source identifier.' awsRegion: title: Amazon EventBridge Integration Region type: string example: ap-south-1 description: 'AWS region associated with the Amazon EventBridge integration. Each region that sends notifications needs its own integration. See the list of AWS regions supported by Splunk Observability Cloud.' type: type: string enum: - AmazonEventBridge example: AmazonEventBridge description: 'Type of service that this integration represents, in the form of an enumerated string, always "AmazonEventBridge".' required: - type type: object description: 'Specifies the properties of the integration between Amazon EventBridge and Splunk Observability Cloud, in the form of a JSON object' - title: Microsoft Azure Active Directory Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - AzureAD example: AzureAD description: 'Type of service that this integration represents, in the form of an enumerated string, always "AzureAD".' required: - type type: object description: 'Specifies the SAML integration between Azure Active Directory and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Azure Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' additionalServices: type: array items: type: string description: Name of a resource type to sync with Splunk Observability Cloud example: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices title: AzureAdditionalServices description: 'Additional Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. If you want to sync Azure resource types that Splunk Observability Cloud doesn''t fully support, add the types to the additionalServices array. The documentation for the services field contains a list of fully supported types. A resource type you specify in additionalServices must meet the following criteria: The type is a Azure GenericResource. For resource types that have hierarchical structure, only the root resource type is a GenericResource. For example, a Storage Account type can have a File Service type, and a File Service type can have a File Storage type. In this case, only Storage Account is a GenericResource. The resource type stores its metrics in Azure Monitor. To learn more about Azure Monitor, refer to the Microsoft Azure documentation. Splunk Observability Cloud syncs resource types that you specify in either services or additionalServices. If you add a resource type to both fields, Splunk Observability Cloud ignores the duplication.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' appId: type: string format: password title: AzureAppId description: 'Azure application ID for Splunk Observability Cloud. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' azureEnvironment: type: string enum: - AZURE - AZURE_US_GOVERNMENT example: AZURE title: AzureEnvironment description: 'Enumerated string that tells Splunk Observability Cloud what type of Azure integration this is. The allowed values are "AZURE_US_GOVERNMENT" and "AZURE". If you don''t specify a value in a POST request, Splunk Observability Cloud defaults to "AZURE".' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' secretKey: type: string format: password title: AzureSecretKey description: 'Azure secret key that associates Splunk Observability Cloud in Azure with the Azure tenant ID. To learn how to get this ID, see the Prepare for Azure integration topic in the Splunk Observability Cloud user documentation. Note: To ensure security, the API doesn''t return this property in response objects.' services: type: array items: type: string enum: - microsoft.analysisservices/servers - microsoft.apimanagement/service - microsoft.automation/automationaccounts - microsoft.batch/batchaccounts - microsoft.cache/redis - microsoft.classiccompute/virtualmachines - microsoft.cognitiveservices/accounts - microsoft.compute/virtualmachines - microsoft.compute/virtualmachinescalesets - microsoft.compute/virtualmachinescalesets/virtualmachines - microsoft.containerinstance/containergroups - microsoft.containerservice/managedclusters - microsoft.customerinsights/hubs - microsoft.datafactory - microsoft.datafactory/datafactories - microsoft.datafactory/factories - microsoft.datalakeanalytics/accounts - microsoft.datalakestore/accounts - microsoft.dbformysql/servers - microsoft.dbforpostgresql/servers - microsoft.devices/elasticpools - microsoft.devices/elasticpools/iothubtenants - microsoft.devices/iothubs - microsoft.devices/provisioningservices - microsoft.documentdb/databaseaccounts - microsoft.eventhub/namespaces - microsoft.hdinsight/clusters - microsoft.keyvault/vaults - microsoft.locationbasedservices/accounts - microsoft.network/applicationgateways - microsoft.network/dnszones - microsoft.network/expressroutecircuits - microsoft.network/loadbalancers - microsoft.network/publicipaddresses - microsoft.network/trafficmanagerprofiles - microsoft.network/virtualnetworkgateways - microsoft.notificationhubs/namespaces/notificationhubs - microsoft.powerbidedicated/capacities - microsoft.relay/namespaces - microsoft.search/searchservices - microsoft.servicebus/namespaces - microsoft.sql/servers - microsoft.sql/servers/databases - microsoft.sql/servers/elasticpools - microsoft.storage/storageaccounts - microsoft.storage/storageaccounts/blobservices - microsoft.storage/storageaccounts/fileservices - microsoft.storage/storageaccounts/queueservices - microsoft.storage/storageaccounts/tableservices - microsoft.streamanalytics/streamingjobs - microsoft.web - microsoft.web/hostingenvironments/multirolepools - microsoft.web/hostingenvironments/workerpools - microsoft.web/serverfarms - microsoft.web/sites/slots example: - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs title: AzureServices description: 'List of Microsoft Azure resource types that you want to sync with Splunk Observability Cloud, in the form of a JSON array of strings. Each element of services must be a resource type that Splunk Observability Cloud fully supports. The specification for array elements in services includes an enumerated list of fully supported types. To see the enumerated list of services, click the arrowhead to expand services, then click the arrowhead to expand ENUM. If you try to add a resource type that''s not in the enumerated list, Splunk Observability Cloud returns a 4xx HTTP response code. Even if the resource type isn''t listed, Splunk Observability Cloud might provide basic support for it. To learn more, see the documentation for the additionalServices field.' subscriptions: type: array items: type: string title: AzureSubscriptions description: 'List of Azure subscriptions that Splunk Observability Cloud should monitor, in the form of a JSON array of strings' resourceFilterRules: type: array items: type: object properties: filter: type: object properties: source: type: string example: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) description: Resource filter title: AzureResourceFilterRules description: 'List of rules to filter Azure resources by their tags. The source of each filter rule must be in the form filter(''key'', ''value''). You can join multiple filter statements using the and and or operators. Referenced keys are limited to tags and must be one of the following: tags prefixed with azure_tag_, or azure_resource_name, azure_resource_group_name or azure_kind.' tenantId: type: string example: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx title: AzureTenantId description: 'Azure ID of the Azure tenant. To learn how to get this ID, see the topic Prepare for Azure integration topic in the Splunk Observability Cloud user documentation.' useBatchApi: type: boolean title: AzureUseBatchApi description: false by default. If false, Splunk Observability Cloud uses the Azure Resource Manager Metrics List API to retrieve metrics. If useBatchApi is set to true, the Azure integration polls data using the Metrics Batch API (also known as the getBatch API or Data Plane API). Use this option to reduce observed throttling and latency. Note that Azure bills for requests to the Metrics Batch API. Refer to Azure documentation for more details. importAzureMonitor: type: boolean title: AzureImportAzureMonitor description: true by default. Controls how Splunk Observability Cloud imports Azure metrics. If set to false, metric sync is disabled, and only metadata is synced. type: type: string enum: - Azure example: Azure description: 'Type of service that this integration represents, in the form of an enumerated string, always "Azure".' syncGuestOsNamespaces: type: boolean example: true title: SyncGuestOsNamespaces description: 'Controls whether Splunk Observability Cloud syncs guest operating system (OS) namespaces. The default of false prevents Splunk Observability Cloud from retrieving metrics from guest OS namespace. Setting the field to true causes Splunk Observability Cloud to add metrics from the namespaces that the Azure Diagnostics extension recommends. These namespaces are are telegraf/mem, telegraf/cpu, and azure.vm.windows.guest. You can set syncGuestOsNamespaces to trueand specifycustomNamespacesPerService` at the same time.' customNamespacesPerService: type: object additionalProperties: type: string example: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace title: CustomNamespacesPerService description: 'Service-to-namespaces map that supports custom metrics for more fine-grained control of syncing. Default is empty. If you specify a map, Splunk Observability Cloud syncs metrics from namespaces in the map in addition to the default namespaces. The keys in customNamespacesPerService must be valid resource types. You can set syncGuestOsNamespaces to true and specify customNamespacesPerService at the same time.' required: - type type: object description: 'Specifies the data collection integration between Microsoft Azure and Splunk Observability Cloud, in the form of a JSON object.' - title: BigPanda Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' appKey: type: string format: password description: 'Application key you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' token: type: string format: password description: 'Token you get from BigPanda. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - BigPanda example: BigPanda description: 'Type of service that this integration represents, in the form of an enumerated string, always "BigPanda".' required: - type type: object description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Google Cloud Platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' pollRate: title: AWS CloudWatch Poll Rate type: integer format: int64 minimum: 60000 maximum: 600000 example: 60000 description: 'Rate at which Splunk Observability Cloud polls data collection integrations, in milliseconds. The minimum value is 60000 ms (1 minute) and the maximum is 600000 ms (10 minutes).' customMetricTypeDomains: title: Custom GCP metrics list type: array example: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos items: type: string description: A single GCP service domain name you want to monitor. description: 'List of GCP service domain names that you want to monitor. Splunk Observability Cloud retrieves metrics from these service domains as well as the services you specify in the services field. If you specify an invalid service domain name, the system responds with an HTTP response code 400 and an error message. To learn more about the customMetricTypeDomains field, see the Custom metric type domains section in the Developer Guide for Splunk Observability Cloud.' namedToken: title: Name of an access token (also known as org token) type: string example: aCloudToken readOnly: false description: 'Name of an existing access token (org token) in your Splunk Observability Cloud organization. To learn more, see the Create and manage organization access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Use namedToken to help you track usage metrics. If you have more than one integration for the same cloud service, use a different access token for each integration. You can then track the resource usage for each integration instance. To learn more about tracking resource usage with access tokens, see the Manage resource usage with access tokens using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation. Note: If you don''t specify namedToken when you create or update a cloud service integration, Splunk Observability Cloud uses the default token for your organization. This token is assigned when your organization is created.' services: type: array items: type: string enum: - appengine - bigquery - bigtable - cloudfunctions - cloudiot - cloudsql - cloudtasks - compute - container - dataflow - datastore - firebasedatabase - firebasehosting - interconnect - loadbalancing - logging - ml - monitoring - pubsub - router - serviceruntime - spanner - storage - vpn example: - appengine - bigquery - bigtable title: GCPServices description: 'Array of GCP services that you want Splunk Observability Cloud to monitor. Splunk Observability Cloud only supports certain services, and if you specify an unsupported one, you receive an API error. The supported services are: "appengine" "bigquery" "bigtable" "cloudfunctions" "cloudiot" "cloudsql" "cloudtasks" "compute" "container" "dataflow" "datastore" "firebasedatabase" "firebasehosting" "interconnect" "loadbalancing" "logging" "ml" "monitoring" "pubsub" "router" "serviceruntime" "spanner" "storage" "vpn" To learn more, see the Connect to GCP topic in the Splunk Observability Cloud user documentation.' projects: title: GCPProjects type: object required: - selectedProjectIds properties: selectedProjectIds: type: array items: type: string example: - xxxxxx-yyyyyy-123456 description: A list of selected project ids. Use this only if syncMode is SELECTED. Only those projects will be synchronized. syncMode: type: string example: ALL_REACHABLE description: Valid values are ALL_REACHABLE or SELECTED. Mode of projects discovery ALL_REACHABLE - automatic synchronization of reachable projects. SELECTED - requires specifying a list of projects in selectedProjectIds. Only those projects will be synchronized. description: Project synchronization configuration. Allows you to choose synchronization mode - automatic synchronization or explicit list of projects. projectServiceKeys: type: array items: type: object required: - projectId - projectKey properties: projectId: type: string example: xxxxxx-yyyyyy-123456 description: GCP project ID you specified when you created your GCP project projectKey: type: string description: 'Contents of the GCP service account key file you generated when you created the project. Ensure that you escape special characters in this value before you you send it to Splunk Observability Cloud. Note: To ensure security, the API doesn''t return the value of this property in a response object.' title: GCPProjectServiceKey description: 'Properties of a GCP project, in the form of a JSON object. Contains the GCP project ID and GCP service account key for a GCP project that you want Splunk Observability Cloud to monitor.' title: GCPProjectServiceKeys description: 'List of GCP projects that you want Splunk Observability Cloud to monitor, in the form of a JSON array of objects' type: type: string enum: - GCP example: GCP description: 'Type of service that this integration represents, in the form of an enumerated string, always "GCP".' whitelist: deprecated: true description: DEPRECATED. Use includeList. includeList: type: array items: type: string minItems: 0 description: GCP metadata name example: - zone - labels - testkey1 - mywhitelist title: GCPIncludeList description: 'List of custom metadata keys that you want Splunk Observability Cloud to collect for GCP Compute Engine instances, in the form of a JSON array.' importGCPMetrics: type: boolean title: GCPImportGCPMetrics description: true by default. Controls how Splunk Observability Cloud imports GCP metrics. If set to false, metric sync is disabled, and only metadata is synced. useMetricSourceProjectForQuota: type: boolean items: type: boolean title: GCPUseMetricSourceProjectForQuota description: Set to true to use a quota from the project where metrics are stored. To use this, the project's service account requires a serviceusage.services.use permission, or you need a Service Usage Consumer role in the project. workloadIdentityFederationConfig: type: string title: GCPWorkloadIdentityFederationConfig description: Workload Identity Federation configuration exported from your account. Instructs Splunk Observability on how to authenticate to your GCP account. workloadIdentityFederationConfigs: deprecated: true type: array items: type: object title: GCPWorkloadIdentityFederationConfigs description: Pairs of projectId and wifConfig, where wifConfig is a Workload Identity Federation configuration. Deprecated. Use workloadIdentityFederationConfig and projects field instead. authMethod: type: string example: WORKLOAD_IDENTITY_FEDERATION title: GCPAuthMethod description: Authentication method. Valid values are WORKLOAD_IDENTITY_FEDERATION or SERVICE_ACCOUNT_KEY. If null it defaults to SERVICE_ACCOUNT_KEY wifSplunkIdentity: type: string readOnly: true example: service_account: splunk-observability@.iam.gserviceaccount.com title: GCPWifSplunkIdentity description: Splunk identity to use in Workload Identity Federation (WIF) attribute conditions and policy bindings excludeGCEInstancesWithLabels: title: GCP Compute Engine instance label exclusion list type: array items: type: string example: - goog-dataproc-cluster-uuid - custom-label description: 'List of label keys. GCP Compute Engine instances with any of these labels applied will be excluded from metric sync. To use this feature, the project''s service account requires a compute.instances.list permission. Note: You shall specify GCP labels as they appear in GCP without the gcp_label_ prefix.' required: - type type: object description: 'Specifies the data collection integration between Google Cloud Platform and Splunk Observability Cloud, in the form of a JSON object.' - title: Google Cloud Identity Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration type: type: string enum: - GoogleSaml example: GoogleSaml description: 'Type of service that this integration represents, in the form of an enumerated string, always "GoogleSaml".' required: - type type: object description: 'Specifies the SAML integration between Google Cloud Identity Integration Model and Splunk Observability Cloud, in the form of a JSON object.' - title: Microsoft Teams Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' webhookUrl: title: Microsoft Teams Integration webhook URL type: string format: uri example: https://.webhook.office.com/webhook2/xxxxxxx description: 'Webhook URL provided by Microsoft Teams. When you create or update the integration, you must provide a Microsoft Teams URL known to Microsoft; otherwise, Microsoft rejects the request. To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - Office365 description: 'Type of service that this integration represents, in the form of an enumerated string. To ensure backward compatibility with previous versions of this integration, the type is "Office365".' required: - type type: object description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object.' - title: Okta Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - Okta example: Okta description: 'Type of service that this integration represents, in the form of an enumerated string, always "Okta".' required: - type type: object description: 'Specifies the SAML integration between Okta and Splunk Observability Cloud, in the form of a JSON object.' - title: OneLogin Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' issuerUrl: title: SAML Integration Entity URL type: string format: uri example: https://www.buttercup.com/o/saml2?idpid=999 description: URL of the entity that issued the certificate for a SAML integration metadataUrl: title: SAML Integration Metadata URL type: string format: uri example: https://www.buttercup.com/saml/99999/metadata.xml description: URL for SAML metadata type: type: string enum: - OneLogin example: OneLogin description: 'Type of service that this integration represents, in the form of an enumerated string, always "OneLogin".' required: - type type: object description: 'Specifies the SAML integration between OneLogin and Splunk Observability Cloud, in the form of a JSON object.' - title: Opsgenie Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'An Opsgenie API key for sending alerts to an Opsgenie team or teams. Note: To ensure security, the API doesn''t return this property in response objects.' apiUrl: type: string format: url example: https://api.buttercup.com/ description: Your Opsgenie API URL type: type: string enum: - Opsgenie example: Opsgenie description: 'Type of service that this integration represents, in the form of an enumerated string, always "Opsgenie".' required: - apiKey - apiUrl - type type: object description: 'Specifies the properties of a notification service integration between Opsgenie and Splunk Observability Cloud, in the form of a JSON object' - title: PagerDuty Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' apiKey: type: string format: password description: 'A key you get from PagerDuty that lets you integrate Splunk Observability Cloud with PagerDuty. PagerDuty refers to this property as the integrationKey. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - PagerDuty example: PagerDuty description: 'Type of service that this integration represents, in the form of an enumerated string, always "PagerDuty".' required: - type type: object description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object.' - title: PingOne Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' metadata: title: SAML Integration Metadata Filename type: string example: FederationMetadata.xml description: 'File name of the SAML metadata XML file for the integration: FederationMetadata.xml' publicKey: title: SAML Integration PEM File type: string format: publickey description: 'Contents of the certificate.pem file for the public key associated with the SAML integration' type: type: string enum: - PingOne example: PingOne description: 'Type of service that this integration represents, in the form of an enumerated string, always "PingOne".' required: - type type: object description: 'Specifies the SAML integration between PingOne and Splunk Observability Cloud, in the form of a JSON object.' - title: ServiceNow Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' instanceName: type: string example: anInstance.service-now.com description: 'ServiceNow instance name, for example myInstances.service-now.com. To learn more, see the Send alert notifications to ServiceNow using Splunk Observability Cloud topic in the Splunk Observability Cloud user documentation.' issueType: type: string enum: - Event - Incident - ImportSet - Problem example: Problem description: 'Type of issue, using standard ITIL terminology. This is an enumerated string that has the following possible values: Event Incident ImportSet Problem' username: type: string example: username description: 'Username you created in ServiceNow for the Splunk Observability Cloud integration. Note: In ServiceNow, you have to assign the roles web_service_admin and itil to this username.' password: type: string format: password description: 'Password associated with the username you created for this integration.' tableName: type: string example: u_incident_import description: Only applicable to integration instances with issueType of ImportSet value. Name of the custom table you created in ServiceNow. Splunk Observability Cloud sends requests to the specified table. type: type: string enum: - ServiceNow example: ServiceNow description: 'Type of service that this integration represents, in the form of an enumerated string, always "ServiceNow".' alertTriggeredPayloadTemplate: type: string example: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertResolvedPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow POST JSON payloads when an alert sends a notification to ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' alertResolvedPayloadTemplate: type: string example: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' description: 'Used in conjunction with alertTriggeredPayloadTemplate. Template that Splunk Observability Cloud uses to create the ServiceNow PUT JSON payloads when an alert is cleared in ServiceNow. Use this optional field to send the values of Splunk Observability Cloud alert properties to specific fields in ServiceNow. The template uses Handlebars variable substitution. For the list of available template variables, see the Template variables section in the Developer Guide for Splunk Observability Cloud. Note: Do not define a sys_id field in your payload; it might corrupt your ServiceNow table structure. This is described in detail in the ServiceNow documentation.' required: - type type: object description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - Webhook - OAuth example: OAuth description: 'Indicates the authentication method you want to use for integrating with the Slack API. This enumerated string has the following allowed values: Webhook OAuth' webhookUrl: type: string description: 'If you set "method": "Webhook", set "webhookUrl" to specify the incoming webhook URL. Note: To ensure security, the API doesn''t return this property in response objects.' scope: type: string description: 'If you set "method": "OAuth", set "scope" to specify the Slack OAuth scope string associated with this integration.' slackTeamName: type: string description: 'If you set "method": "OAuth", use "slackTeamName" to specify the name of the Slack team you''ve approved for this integration.' slackTeamId: type: string description: 'If you set the "method" property to "OAuth", use "slackTeamId" to specify the Slack ID for the Slack team you''ve approved for this integration.' slackUserId: type: string description: 'If you set the "method" property to "OAuth", use "slackUserId" to specify the Slack ID for the Slack user that approved this integration.' accessTokenUpdated: type: integer format: int64 example: 1555929030000 description: 'If you set the "method" property to "OAuth", "accessTokenUpdated" contains the last time that Slack refreshed or updated the access token. The value is in Unix time.' type: type: string enum: - Slack example: Slack description: 'Type of service that this integration represents, in the form of an enumerated string, always "Slack".' required: - type type: object description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk On-Call Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' postUrl: type: string description: 'Splunk On-Call API integration URL. Note: To ensure security, the API doesn''t return this property in response objects.' type: type: string enum: - VictorOps example: VictorOps description: 'Type of service that this integration represents, in the form of an enumerated string, always "VictorOps".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Splunk platform Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' type: type: string enum: - SplunkPlatform example: SplunkPlatform description: 'Type of service that this integration represents, in the form of an enumerated string, always "SplunkPlatform"' url: type: string format: uri example: https://http-inputs-.splunkcloud.com description: Specify the HTTP Event Collector (HEC) URI for your Splunk platform instance. To learn more about HEC in Splunk platform, see the Send data to HTTP Event Collector section in the Documentation for Splunk Cloud Platform. hecToken: type: string example: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 description: 'HTTP Event Collector token that allows access to your Splunk platform instance. Splunk Observability Cloud doesn''t support HEC indexer acknowledgement. To use the Splunk platform integration, don''t activate indexer acknowledgement for HEC token in your Splunk Enterprise instance. Note: The value of hecToken isn''t returned in the response body.' payloadTemplate: type: string description: 'Customize the Splunk platform alert payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For the full list of supported variables, see the Supported variables for Splunk platform integration custom payload section in the Splunk Observability Cloud user documentation.' required: - type type: object description: Specifies the properties of a notification service integration between Splunk Observability Cloud and Splunk platform, in the form of a JSON object - title: Webhook Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' method: type: string enum: - POST - PUT - GET example: POST default: POST description: HTTP method used to send webhook data. Valid methods include POST, PUT, and GET payloadTemplate: type: string example: severity: '{{{severity}}}' originatingMetric: '{{{originatingMetric}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' messageBody: '{{{encodeString messageBody}}}' src: '{{{src}}}' inputs: '{{{json inputs}}}' rule: '{{{encodeString rule}}}' description: '{{{encodeString description}}}' messageTitle: '{{{encodeString messageTitle}}}' sf_schema: '{{{sf_schema}}}' eventType: '{{{eventType}}}' runbookUrl: '{{{runbookUrl}}}' orgId: '{{{orgId}}}' detectorId: '{{{detectorId}}}' imageUrl: '{{{imageUrl}}}' tip: '{{{encodeString tip}}}' statusExtended: '{{{statusExtended}}}' incidentId: '{{{incidentId}}}' detector: '{{{encodeString detector}}}' detectorUrl: '{{{detectorUrl}}}' status: '{{{status}}}' timestamp: '{{{timestamp}}}' dimensions: '{{{json dimensions}}}' description: 'Customize the webhook payload using Handlebars syntax. If you don''t specify the payloadTemplate property, the default payload is used. For more information, see Webhook default payload. For the full list of supported variables, see the Integrate a webhook with Splunk Observability Cloud topic in the Developer Guide for Splunk Observability Cloud.' url: type: string format: uri example: https://example.com/alarm/{{incidentId}}?status={{status}} description: Specify webhook's external site URL. You can use the Handlebars syntax for this URL. sharedSecret: type: string format: password description: 'Value that Splunk Observability Cloud uses as the secret cryptographic key in a message authentication code computation based on the HMAC-SHA256 algorithm. The Shared secret section in the Developer Guide for Splunk Observability Cloud describes the use sharedSecret in more detail. When you use sharedSecret, you need to know the steps Splunk Observability Cloud uses to compute the message authentication code, so you can perform the same computation and compare your results to a value you receive in the webhook request. sharedSecret is not returned in the response body.' headers: type: object example: Content-Type: application/json description: 'Associative array of HTTP headers and values, in the form of a JSON object. Splunk Observability Cloud adds the headers and values to HTTP requests sent to the webhook''s external site. When you provide a value for the payloadTemplate property, the headers property is used to determine expected payload type. When the headers property specifies "Content-Type" as "application/json" or "application/ld+json", Splunk Observability Cloud validates that the payload template produces a valid JSON objects. When no "Content-Type" is specified, Splunk Observability Cloud assumes you want to use a JSON payload and uses that validation.' type: type: string enum: - Webhook example: Webhook description: 'Type of service that this integration represents, in the form of an enumerated string, always "Webhook".' required: - type type: object description: 'Specifies the properties of a notification service integration between Splunk Observability Cloud and an external site' - title: xMatters Integration properties: created: title: Integration Creation Time type: integer format: int64 example: 1556361030000 readOnly: true description: 'Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only' createdByName: title: Integration Creator Name type: string readOnly: true example: Dana Cruz description: Name of the user that created the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. creator: title: Integration Creator ID type: string readOnly: true example: X_xxxx9XXXX description: 'ID of the user that created the integration. If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' enabled: title: Integration Enabled Flag type: boolean example: true description: 'Indicates the state of the integration. If true, the integration is enabled. If false, the integration is disabled, and you must enable it by setting "enabled" to true in a PUT request that updates the object. When you create an integration, set this property according to the instructions in the user documentation. Some integrations, such as AWS, expect the initial value to be false, which lets you create the integration and use its properties to set values in AWS.' id: title: Integration ID type: string readOnly: true example: XXxxxXXXXXX description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to an integration using the GET, PUT, or DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.' lastUpdated: title: Integration Last Updated Timestamp type: integer format: int64 example: 1556620230000 readOnly: true description: 'Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only' lastUpdatedBy: title: Integration Last Updater ID type: string readOnly: true example: Y_yyyy0YYYY description: 'ID of the user who last updated the integration. If Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA". Set by Splunk Observability Cloud; read-only' lastUpdatedByName: title: Integration Last Updater Name type: string readOnly: true example: Ariel Amal description: Name of the user that last updated the integration. Set to null by default. Use GET /integration or GET /integration/{id} with the userParam query parameter to return a user name instead of null. Set by Splunk Observability Cloud based on the full name value from the user's profile; read-only. name: title: Integration Label type: string example: MyIntegration description: 'Human-readable label for the integration. Use this property to identify a specific integration when you''re using multiple integrations for the same service.' url: type: string format: uri example: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' description: 'Webhook URL that connects the integration to your xMatters account. You get this URL from your xMatters account. To learn how, see the "SignalFx" topic in the "Integrations" section of the xMatters website.' type: type: string enum: - XMatters example: XMatters description: 'Type of service that this integration represents, in the form of an enumerated string, always "XMatters".' required: - type type: object description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' examples: Microsoft ADFS Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: ADFS AWS CloudWatch Integration: value: authMethod: ExternalId collectOnlyRecommendedStats: true created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customCloudWatchNamespaces: string customNamespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: string enableAwsUsage: true enableCheckLargeVolume: true enabled: true externalId: abcdefghijklmnopqrst id: XXxxxXXXXXX ignoreAllStatusMetrics: true importCloudWatch: true inactiveMetricsPollRate: 300000 includeEMRInstancesMetrics: true isLargeVolume: false key: string lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataPollRate: 900000 metricStatsToSync: AWS/EC2: NetworkPacketsIn: - mean - lower AWS/ECS: CPUReservation: - mean CPUUtilization: - upper - mean - p95 - p99 - p99.5 metricStreamsManagedExternally: true metricStreamsSyncState: ENABLED name: MyIntegration namedToken: aCloudToken namespacesExcludeTagSync: - AWS/ElasticBeanstalk - AWS/ElastiCache namespaceSyncRules: - defaultAction: Exclude filter: action: Include namespace: AWS/DynamoDB pollRate: 60000 prePauseState: metricStreamsSyncState: ENABLED regions: - us-east-1 - us-east-2 - us-west-1 - us-west-2 roleArn: arn:aws:iam::123456789012:role/myIntegration services: - AWS/DynamoDB syncCustomNamespacesOnly: true syncLoadBalancerTargetGroupTags: true token: string type: AWSCloudWatch Amazon EventBridge Integration: value: awsAccountId: 123456789012 awsRegion: ap-south-1 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true eventSource: aws.partner/buttercup.com/abcdefghijklmnopqrst id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: AmazonEventBridge Microsoft Azure Active Directory Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: AzureAD Microsoft Azure Integration: value: additionalServices: - microsoft.connectedvehicle/platformaccounts - microsoft.media/mediaservices appId: string azureEnvironment: AZURE created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customNamespacesPerService: Microsoft.Compute/virtualMachines: - monitoringAgent - customNamespace enabled: true id: XXxxxXXXXXX importAzureMonitor: true lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 resourceFilterRules: - filter: source: filter('azure_tag_service', 'payment') and (filter('azure_tag_env', 'prod-us') or filter('azure_tag_env', 'prod-eu')) secretKey: string services: - - microsoft.analysisservices/servers - microsoft.search/searchservices - microsoft.customerinsights/hubs subscriptions: - string syncGuestOsNamespaces: true tenantId: 999xxx9x-xx99-9xxx-x99x-9xx9999999xx type: Azure useBatchApi: true BigPanda Integration: value: appKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration token: string type: BigPanda Google Cloud Platform Integration: value: authMethod: WORKLOAD_IDENTITY_FEDERATION created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX customMetricTypeDomains: - custom.googleapis.com - external.googleapis.com/prometheus - aws.googleapis.com/EC2 - kubernetes.io/anthos enabled: true excludeGCEInstancesWithLabels: - goog-dataproc-cluster-uuid - custom-label id: XXxxxXXXXXX importGCPMetrics: true includeList: - zone - labels - testkey1 - mywhitelist lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration namedToken: aCloudToken pollRate: 60000 projects: selectedProjectIds: - xxxxxx-yyyyyy-123456 syncMode: ALL_REACHABLE projectServiceKeys: - projectId: xxxxxx-yyyyyy-123456 projectKey: string services: - appengine - bigquery - bigtable type: GCP useMetricSourceProjectForQuota: true wifSplunkIdentity: service_account: splunk-observability@.iam.gserviceaccount.com workloadIdentityFederationConfig: string Google Cloud Identity Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: GoogleSaml Microsoft Teams Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Office365 webhookUrl: https://.webhook.office.com/webhook2/xxxxxxx Okta Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: Okta OneLogin Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX issuerUrl: https://www.buttercup.com/o/saml2?idpid=999 lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadataUrl: https://www.buttercup.com/saml/99999/metadata.xml name: MyIntegration publicKey: string type: OneLogin Opsgenie Integration: value: apiKey: string apiUrl: https://api.buttercup.com/ created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: Opsgenie PagerDuty Integration: value: apiKey: string created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: PagerDuty PingOne Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal metadata: FederationMetadata.xml name: MyIntegration publicKey: string type: PingOne ServiceNow Integration: value: alertResolvedPayloadTemplate: '"{\"records\":[{ \"state\": \"6\", \"close_code\": \"Closed/Resolved by Caller\", \"close_notes\": \"{{{messageTitle}}} (customized close msg)\", \"comments\": \"{{{messageBody}}}\", \"u_service_type_mtom\": \"business_service_internal\", \"impact\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' alertTriggeredPayloadTemplate: '"{\"records\":[{ \"correlation_id\": \"{{{incidentId}}}\", \"short_description\": \"{{{messageTitle}}} (customized)\", \"u_service_type_mtom\": \"business_service_internal\", \"category\": \"other_int\", \"description\": \"{{{messageBody}}} (customized)\",\"impact\": \"{{{impact}}}\", \"urgency\": \"{{{impact}}}\", \"caller_id\": \"{{{callerId}}}\"}]}" ' created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX instanceName: anInstance.service-now.com issueType: Problem lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration password: string tableName: u_incident_import type: ServiceNow username: username Slack Integration: value: accessTokenUpdated: 1555929030000 created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: OAuth name: MyIntegration scope: string slackTeamId: string slackTeamName: string slackUserId: string type: Slack webhookUrl: string Splunk On-Call Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration postUrl: string type: VictorOps Splunk platform Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true hecToken: CF179AE4-3C99-45F5-A7CC-3284AA91CF67 id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration payloadTemplate: string type: SplunkPlatform url: https://http-inputs-.splunkcloud.com Webhook Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true headers: Content-Type: application/json id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal method: POST name: MyIntegration payloadTemplate: description: '{{{encodeString description}}}' detectOffCondition: '{{{encodeString detectOffCondition}}}' detectOnCondition: '{{{encodeString detectOnCondition}}}' detector: '{{{encodeString detector}}}' detectorId: '{{{detectorId}}}' detectorUrl: '{{{detectorUrl}}}' dimensions: '{{{json dimensions}}}' eventType: '{{{eventType}}}' imageUrl: '{{{imageUrl}}}' incidentId: '{{{incidentId}}}' inputs: '{{{json inputs}}}' messageBody: '{{{encodeString messageBody}}}' messageTitle: '{{{encodeString messageTitle}}}' orgId: '{{{orgId}}}' originatingMetric: '{{{originatingMetric}}}' rule: '{{{encodeString rule}}}' runbookUrl: '{{{runbookUrl}}}' severity: '{{{severity}}}' sf_schema: '{{{sf_schema}}}' src: '{{{src}}}' status: '{{{status}}}' statusExtended: '{{{statusExtended}}}' timestamp: '{{{timestamp}}}' tip: '{{{encodeString tip}}}' sharedSecret: string type: Webhook url: https://example.com/alarm/{{incidentId}}?status={{status}} xMatters Integration: value: created: 1556361030000 createdByName: Dana Cruz creator: X_xxxx9XXXX enabled: true id: XXxxxXXXXXX lastUpdated: 1556620230000 lastUpdatedBy: Y_yyyy0YYYY lastUpdatedByName: Ariel Amal name: MyIntegration type: XMatters url: 'https://user.buttercup.com/api/integration/1/functions/ffffffff-ffff-ffff-ffff-ffffffffffff/triggers?apiKey=ffffffff-ffff-ffff-ffff-ffffffffffff ' '400': description: HTTP 400 response content: application/json: schema: oneOf: - title: AWS CloudWatch failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text message for the error. Always "Poll rate value x ms is out of the range. Supported poll rate values are 60000 - 600000 ms.", where x is the polling rate specified in the request.' title: AWSIntegrationFailurePollRateValue description: 'Request failed because the specified polling rate is out of range. The API only accepts values between 60000 (1 minute in milliseconds) and 600000 (10 minutes in milliseconds).' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Unknown namedToken value: "' example: code: 400 example: 'Unknown namedToken value: my-org-token' title: CommonIntegrationFailureInvalidOrgToken description: 'Request failed because Splunk Observability Cloud can''t find any access tokens (or org tokens) that have the name you specified in namedToken. This error message can only occur in response to the following operations: POST integration: Create an integration PUT integration/{INTEGRATION_ID>}: Update an existing integration' description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a create or update request for an AWS CloudWatch integration. The code property is always in the 4xx HTTP response code range. The message property value depends on the type of failure.' - title: Generic failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Unknown namedToken value: "' example: code: 400 example: 'Unknown namedToken value: my-org-token' title: CommonIntegrationFailureInvalidOrgToken description: 'Request failed because Splunk Observability Cloud can''t find any access tokens (or org tokens) that have the name you specified in namedToken. This error message can only occur in response to the following operations: POST integration: Create an integration PUT integration/{INTEGRATION_ID>}: Update an existing integration' description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a create, retrieve, update, or delete request for any of the possible integrations The code property is always in the 4xx HTTP response code range. The message property value depends on the type of failure.' - title: Jira failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error Always "Expected single issue type in Jira response, got [ ]. Unknown issue type."' example: code: 400 message: Expected single issue type in Jira response, got [ ]. Unknown issue type. title: JiraIntegrationFailureInvalidIssueType description: 'Request failed because the specified Jira issue type is invalid. Splunk Observability Cloud validates issue types to ensure that the type exists for the specified Jira project.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Expected single project in Jira response, got { "projects" : [ ] }. User may not exist or does not have permissions to browse projects."' example: code: 400 message: '"Expected single project in Jira response, got { \"projects\" : [ ] }. User may not exist or does not have permissions to browse projects." ' title: JiraIntegrationFailureUnknownUser description: 'Request failed because of one of the following Jira user errors: Jira user is not well-formed Jira user is not known to Jira Jira user doesn''t have the proper authorization' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Expected single project in Jira response, got { "projects" : [ ] }. User may not exist or does not have permissions to browse projects."' example: code: 400 message: '"Expected single project in Jira response, got { \"projects\" : [ ] }. User may not exist or does not have permissions to browse projects." ' title: JiraIntegrationFailureUnknownProject description: Request failed because the specified Jira project doesn't exist - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: 'Human-readable text for the error. Always "Failed to de-serialize payload at: sf.rest.shared.model.integration.JiraIntegration["authMethod"]"' example: code: 400 message: '"Failed to de-serialize payload at: sf.rest.shared.model.integration.JiraIntegration[\"authMethod\"]" ' title: JiraIntegrationFailureUnknownAuthMethod description: 'Request failed because the specified Jira authentication method doesn''t exist' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error. Might contain debug output. example: code: 400 message: Invalid token title: JiraIntegrationFailureInvalidApiToken description: Request failed because the specified Jira API token is invalid description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a create, retrieve, update, or delete request for a Jira integration The code property is always in the 4xx HTTP response code range. The message property value depends on the type of failure. In some cases, the message comes directly from the Jira instance rather than from Splunk Observability Cloud.' - title: Microsoft Teams failure responses oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 401 (Unauthorized) message: type: string description: 'Human-readable text message for the error. Always "Problem accessing /v2/integration. Reason: Unauthorized"' example: code: 401 message: 'Problem accessing /v2/integration. Reason: Unauthorized' title: CommonIntegrationFailureAuthentication description: 'Request failed, because of one of the following authentication errors: Token has expired User associated with a session token (User API Access Token) does not have administrative access' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' - type: object properties: code: type: integer description: HTTP response code. Always 404(Not Found) message: type: string description: Human-readable text for the error. Always "Unable to find the given integration." example: code: 404 example: Unable to find the given integration. title: CommonIntegrationFailureUnknownIntegrationId description: 'Request failed because Splunk Observability Cloud can''t find the specified integration ID. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an ID that isn''t well-formed.' - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error example: code: 400 message: WebhookUrl is invalid title: MSTeamsIntegrationFailureInvalidWebhookUrl description: Request failed because the webhook URL is not well-formed - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error example: code: 400 message: MSTeams API returns '400 Bad Request' Invalid webhook URL title: MSTeamsIntegrationFailureInvalidWebhookUrlMS description: Request failed because Microsoft rejected the specified webhook URL - type: object properties: code: type: integer description: HTTP response code. Always 410 (Gone) message: type: string description: Human-readable text for the error example: code: 410 message: Connector configuration not found title: MSTeamsIntegrationFailureMissingConnector description: Request failed because user didn't save connector information in MS Teams - type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text for the error example: code: 400 message: WebhookUrl is missing title: MSTeamsIntegrationFailureNoWebhookUrl description: Request failed because webhook URL is missing description: 'Properties returned from Splunk Observability Cloud when a failure occurs for a Microsoft Teams integration request. The code and message properties depend on the type of failure. Two different failures might occur because of an invalid webhook URL. Splunk Observability Cloud returns the following messages: "WebhookUrl is invalid". Returned when the URL is not well-formed "Office365 API returns ''400 Bad Request'' Invalid webhook URL". Returned when Microsoft rejects the specified webhook URL' examples: AWSIntegrationFailure: summary: 'An attempt to update an AWS CloudWatch integration failed because the specified polling rate is invalid. ' value: code: 400 message: Poll rate value 1 ms is out of the range. Supported poll rate values are 60000 - 600000 ms. IntegrationFailure: summary: 'An attempt to update the integration failed because the session token isn''t associated with a user who has administrative access. ' value: code: 401 message:

HTTP ERROR 401

Problem accessing /v2/integration. Reason:

    Unauthorized

JiraIntegrationFailure: summary: 'The attempt to update a Jira integration failed because the request specified an issue type that isn''t known to Jira. ' value: code: 400 message: Expected single issue type in Jira response, got [ ]. Unknown issue type. '500': description: HTTP 500 response content: application/json: schema: oneOf: - type: object properties: code: type: integer description: HTTP response code. Always 500 (Internal Server Error) message: type: string description: 'Human-readable error text. Has the form "Integration type not found" where is the integration type specified in the request' example: code: 500 message: Integration type 'Office366' not found title: CommonIntegrationFailureBadTypeInPayload description: Request failed because the specified integration type is invalid examples: GenericBadRequest: value: code: 500 message: Integration type not found security: - SessionToken: [] tags: - Integrations delete: summary: Delete Single Integration description: 'Deletes the integration object specified by the id path parameter. Note: This API doesn''t require a request body, and doesn''t return a response body.' parameters: - name: id in: path description: 'ID of the existing integration object that you want to delete' required: true schema: type: string - name: X-SF-TOKEN in: header description: 'Authentication token. Must be a session token (User API access token) associated with an administrator.' required: true schema: type: string responses: '200': description: HTTP 200 response '400': description: HTTP 400 response content: application/json: schema: type: object properties: code: type: integer description: HTTP response code. Always 400 (Bad Request) message: type: string description: Human-readable text message for the error. Always "Invalid ID ". example: code: 400 message: Invalid ID title: CommonIntegrationFailureInvalidIntegrationId description: 'Request failed because the specified integration ID is not well-formed. This error message can only occur in response to the following operations: PUT integration/: Update an existing integration DELETE integration/{INTEGRATION_ID>}: Delete an existing integration This failure is not the same as a failure because of an unknown ID.' examples: example: value: code: 400 message: Invalid ID security: - SessionToken: [] tags: - Integrations /integration/validate/{id}: get: summary: Validate Integration description: 'Validates the credentials of an existing integration. Integrations such as AWS or GCP might have permission changes. Use this API to verify that the integration is still valid. Note: This API doesn''t require a request body, and doesn''t return a response body.' parameters: - name: id in: path description: 'ID of the existing integration object that you want to validate' required: true schema: type: string - name: X-SF-TOKEN in: header description: 'Authentication token. Must be a session token (User API access token) associated with an administrator.' required: true schema: type: string responses: '200': description: HTTP 200 response security: - SessionToken: [] tags: - Integrations