openapi: 3.0.3 info: title: Splunk Observability Cloud — SLOs version: 1.0.0 description: 'API for creating, retrieiving, and managing service level objectives (SLOs). Requirements You must have an organization access token with the API permission or a session token to use the API. You have to have the Splunk Observability Cloud admin or power role to use the POST /slo, POST /slo/search, POST /slo/validate, PUT /slo/{id}, and DELETE /slo/{id} operations. You have to have the Splunk Observability Cloud admin, power, or read_only role to use the GET /slo/{id} operation.' x-provenance: method: reconstructed authored_by: Splunk (content) / API Evangelist (assembly) reconstructed_by: API Evangelist reconstructed_on: '2026-08-19' first_party: false provider_published: false note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's. Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset path, including invented control paths — so this is NOT first-party publication and is not graded as such. x-evidence: - type: source url: https://dev.splunk.com/observability/reference/ - type: source url: https://dev.splunk.com/observability/docs/apibasics/api_list/ servers: - url: https://api.{REALM}.observability.splunkcloud.com/v2 description: SLO API endpoint URL variables: REALM: default: us0 description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0). security: - SessionToken: [] components: securitySchemes: SessionToken: type: apiKey in: header name: X-SF-Token description: Splunk Observability Cloud session token or org access token. paths: /slo: post: summary: Create New SLO description: Properties used to create a new SLO object parameters: - name: Content-Type in: header description: Request body format. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string requestBody: required: true content: application/json: schema: title: Create SLO Request Body type: object required: - name - type - inputs - targets properties: description: title: Description of the SLO type: string example: My SLO test description: Description of the SLO name: title: Name of the SLO type: string example: Test SLO description: Name of the SLO. Each SLO name must be unique within an organization type: title: Type of SLO type: string enum: - RequestBased description: 'Type of the SLO. You can configure your SLO as the following type: Request-based SLO: Measurement tracks the successful request count and total request count' inputs: title: SLO inputs oneOf: - title: Request Based Input SLO Type type: object required: - programText - totalEventsLabel - goodEventsLabel properties: programText: type: string example: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' description: SignalFlow program and arguments text strings that define the streams used as successful event count and total event count totalEventsLabel: type: string example: B description: Label used in programText that refers to the data block which contains the stream of total events goodEventsLabel: type: string example: A description: Label used in programText that refers to the data block which contains the stream of successful events description: Properties to congifure an SLO object configured request-based inputs example: programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' goodEventsLabel: A totalEventsLabel: B description: Inputs to configure your SLO targets: title: SLO target array type: array minItems: 1 maxItems: 1 items: title: SLO Target type: object required: - compliancePeriod - cycleType - cycleStart - slo - type - sloAlertRules properties: compliancePeriod: type: string example: 30d description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d (30 days), inclusive. cycleType: type: string enum: - week - month example: week description: 'Cycle type for this SLO target, either week or month. Note: Required only when SLO target type is CalendarWindow.' cycleStart: type: string example: monday description: 'Starting point for the cycle of this SLO target. For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday, and so on. For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive. Note: Required only when SLO target type is CalendarWindow.' slo: type: number format: double minimum: 0 exclusiveMinimum: true exclusiveMaximum: true maximum: 100 example: 99.99 description: Target value in the form of a percentage type: type: string enum: - RollingWindow - CalendarWindow example: RollingWindow description: 'SLO target can be the following type: RollingWindow CalendarWindow' sloAlertRules: type: array items: title: SLO Alert Rule Object type: object required: - type - rules properties: type: type: string enum: - BREACH - ERROR_BUDGET_LEFT - BURN_RATE example: BREACH description: 'SLO alert rule can be one of the following types: BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified compliance window. ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage of the estimated error budget for the compliance window. BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy threshold for the specified compliance window. Note: Within an SLO object, you can only specify one SLO alert rule per type. For example, you can''t specify two objects of type BREACH in the same sloAlertRules list.' alertsTriggered: type: boolean readOnly: true default: false description: When the system sets this to true, there is at least one active alert for this SLO alert rule rules: type: array items: title: SLO Alert Rule Object type: object required: - severity properties: description: type: string example: Alert when the target has been breached for 5 minutes description: Description for the rule detectLabel: type: string example: label disabled: type: boolean default: false example: false description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from an SLO alert to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a an SLO alert notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string readOnly: false writeOnly: false description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. Prerequisits to send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tAlert rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tAlert rule\ \ \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\" cleared at {{dateTimeFormat timestamp\ \ format=\"full\"}}.\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n\ {{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{ruleName}}} in SLO {{{sloName}}} description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check the SLO in Splunk Observability Cloud parameters: title: Parameters for SLO alert rule type: object properties: fireLasting: type: string default: 5m example: 5m description: 'Duration that indicates how long the alert condition is met before the alert is triggered. The value must be positive and smaller than the compliance period of the SLO target. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the fireLasting parameter.' percentOfLasting: type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 100 example: 100 description: 'Percentage of the fireLasting duration that the alert condition is met before the alert is triggered. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the percentOfLasting parameter' percentErrorBudgetLeft: title: Percent Error Budget Left Parameter type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 10 example: 10 description: 'Error budget must be equal to or smaller than this percentage for the alert to be triggered. Note: ERROR_BUDGET_LEFT alert rules use the percentErrorBudgetLeft parameter' shortWindow1: title: Short Window 1 Parameter nullable: false type: string default: 5m example: 5m description: 'Short window 1 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow1. Note: BURN_RATE alert rules use the shortWindow1 parameter' longWindow1: title: Long Window 1 Parameter nullable: false type: string default: 1h example: 1h description: 'Long window 1 used in burn rate alert calculation. This value must be longer than shortWindow1 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow1 parameter' shortWindow2: title: Short Window 2 Parameter nullable: false type: string default: 30m example: 30m description: 'Short window 2 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow2. Note: shortWindow2 parameter is used only in BURN_RATE alert rules.' longWindow2: title: Long Window 2 Parameter nullable: false type: string default: 6h example: 6h description: 'Long window 2 used in burn rate alert calculation. This value must be longer than shortWindow2 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow2 parameter' burnRateThreshold1: title: Burn Rate Threshold 1 Parameter nullable: false type: number format: double example: 14.4 description: 'Burn rate threshold 1 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold1 parameter' burnRateThreshold2: title: Burn Rate Threshold 2 Parameter nullable: false type: number format: double example: 6 description: 'Burn rate threshold 2 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold2 parameter' description: Parameters for the SLO alert rule in the form of a JSON object. Each SLO alert rule type accepts different parameters. If not specified, default parameters are used. description: Single SLO alert rule maxItems: 1 minItems: 1 description: List of rules in the form of a JSON array. Each element is a single alert rule object. description: Properties of an SLO alert rule object maxItems: 3 minItems: 1 description: 'List of alert rules you want to set for this SLO target in the form of a JSON array. Each element is a single SLO target alert rule. Note: An SLO alert rule of type BREACH is always required.' description: Properties of an SLO target object example: - compliancePeriod: 30d slo: 99.99 type: RollingWindow sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com - type: Slack channel: slack_channel credentialId: AAAAAAAABLw parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - type: Email email: test@gmail.com parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE description: List of targets you want to set for your SLO in the form of a JSON array. Each element is a single SLO target. description: Properties to use in creating a new SLO using the API examples: example: value: description: My SLO test inputs: goodEventsLabel: A programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' totalEventsLabel: B name: Test SLO targets: - compliancePeriod: 30d slo: 99.99 sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email - channel: slack_channel credentialId: AAAAAAAABLw type: Slack parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - email: test@gmail.com type: Email parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE type: RollingWindow type: RequestBased responses: '200': description: HTTP 200 response content: application/json: schema: title: Create SLO Response Body type: object properties: created: title: SLO creation time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time the SLO was created in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. creator: title: Creator user ID type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who created this SLO. This property is read-only and is generated by the system. id: title: ID of the SLO type: string readOnly: true example: FrvcMakAAAA description: ID of the SLO. This property is read-only and is generated by the system. description: title: Description of the SLO type: string example: My SLO test description: Description of the SLO name: title: Name of the SLO type: string example: Test SLO description: Name of the SLO. Each SLO name must be unique within an organization type: title: Type of SLO type: string enum: - RequestBased description: 'Type of the SLO. You can configure your SLO as the following type: Request-based SLO: Measurement tracks the successful request count and total request count' inputs: title: SLO inputs oneOf: - title: Request Based Input SLO Type type: object required: - programText - totalEventsLabel - goodEventsLabel properties: programText: type: string example: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' description: SignalFlow program and arguments text strings that define the streams used as successful event count and total event count totalEventsLabel: type: string example: B description: Label used in programText that refers to the data block which contains the stream of total events goodEventsLabel: type: string example: A description: Label used in programText that refers to the data block which contains the stream of successful events description: Properties to congifure an SLO object configured request-based inputs example: programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' goodEventsLabel: A totalEventsLabel: B description: Inputs to configure your SLO targets: title: SLO target array type: array minItems: 1 maxItems: 1 items: title: SLO Target type: object required: - compliancePeriod - cycleType - cycleStart - slo - type - sloAlertRules properties: compliancePeriod: type: string example: 30d description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d (30 days), inclusive. cycleType: type: string enum: - week - month example: week description: 'Cycle type for this SLO target, either week or month. Note: Required only when SLO target type is CalendarWindow.' cycleStart: type: string example: monday description: 'Starting point for the cycle of this SLO target. For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday, and so on. For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive. Note: Required only when SLO target type is CalendarWindow.' slo: type: number format: double minimum: 0 exclusiveMinimum: true exclusiveMaximum: true maximum: 100 example: 99.99 description: Target value in the form of a percentage type: type: string enum: - RollingWindow - CalendarWindow example: RollingWindow description: 'SLO target can be the following type: RollingWindow CalendarWindow' sloAlertRules: type: array items: title: SLO Alert Rule Object type: object required: - type - rules properties: type: type: string enum: - BREACH - ERROR_BUDGET_LEFT - BURN_RATE example: BREACH description: 'SLO alert rule can be one of the following types: BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified compliance window. ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage of the estimated error budget for the compliance window. BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy threshold for the specified compliance window. Note: Within an SLO object, you can only specify one SLO alert rule per type. For example, you can''t specify two objects of type BREACH in the same sloAlertRules list.' alertsTriggered: type: boolean readOnly: true default: false description: When the system sets this to true, there is at least one active alert for this SLO alert rule rules: type: array items: title: SLO Alert Rule Object type: object required: - severity properties: description: type: string example: Alert when the target has been breached for 5 minutes description: Description for the rule detectLabel: type: string example: label disabled: type: boolean default: false example: false description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from an SLO alert to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a an SLO alert notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string readOnly: false writeOnly: false description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. Prerequisits to send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tAlert rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tAlert rule\ \ \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\" cleared at {{dateTimeFormat timestamp\ \ format=\"full\"}}.\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n\ {{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{ruleName}}} in SLO {{{sloName}}} description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check the SLO in Splunk Observability Cloud parameters: title: Parameters for SLO alert rule type: object properties: fireLasting: type: string default: 5m example: 5m description: 'Duration that indicates how long the alert condition is met before the alert is triggered. The value must be positive and smaller than the compliance period of the SLO target. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the fireLasting parameter.' percentOfLasting: type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 100 example: 100 description: 'Percentage of the fireLasting duration that the alert condition is met before the alert is triggered. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the percentOfLasting parameter' percentErrorBudgetLeft: title: Percent Error Budget Left Parameter type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 10 example: 10 description: 'Error budget must be equal to or smaller than this percentage for the alert to be triggered. Note: ERROR_BUDGET_LEFT alert rules use the percentErrorBudgetLeft parameter' shortWindow1: title: Short Window 1 Parameter nullable: false type: string default: 5m example: 5m description: 'Short window 1 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow1. Note: BURN_RATE alert rules use the shortWindow1 parameter' longWindow1: title: Long Window 1 Parameter nullable: false type: string default: 1h example: 1h description: 'Long window 1 used in burn rate alert calculation. This value must be longer than shortWindow1 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow1 parameter' shortWindow2: title: Short Window 2 Parameter nullable: false type: string default: 30m example: 30m description: 'Short window 2 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow2. Note: shortWindow2 parameter is used only in BURN_RATE alert rules.' longWindow2: title: Long Window 2 Parameter nullable: false type: string default: 6h example: 6h description: 'Long window 2 used in burn rate alert calculation. This value must be longer than shortWindow2 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow2 parameter' burnRateThreshold1: title: Burn Rate Threshold 1 Parameter nullable: false type: number format: double example: 14.4 description: 'Burn rate threshold 1 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold1 parameter' burnRateThreshold2: title: Burn Rate Threshold 2 Parameter nullable: false type: number format: double example: 6 description: 'Burn rate threshold 2 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold2 parameter' description: Parameters for the SLO alert rule in the form of a JSON object. Each SLO alert rule type accepts different parameters. If not specified, default parameters are used. description: Single SLO alert rule maxItems: 1 minItems: 1 description: List of rules in the form of a JSON array. Each element is a single alert rule object. description: Properties of an SLO alert rule object maxItems: 3 minItems: 1 description: 'List of alert rules you want to set for this SLO target in the form of a JSON array. Each element is a single SLO target alert rule. Note: An SLO alert rule of type BREACH is always required.' description: Properties of an SLO target object example: - compliancePeriod: 30d slo: 99.99 type: RollingWindow sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com - type: Slack channel: slack_channel credentialId: AAAAAAAABLw parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - type: Email email: test@gmail.com parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE description: List of targets you want to set for your SLO in the form of a JSON array. Each element is a single SLO target. metadata: title: SLO Metadata type: array items: type: string readOnly: true example: - sf_sloMetricName:spans.count - sf_service:* description: Read-only metadata of this SLO, set by the system based on the inputs property. lastUpdated: title: SLO last updated time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time when this SLO was last udpated, in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. lastUpdatedBy: title: User who last updated this SLO type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who last updated this SLO. This property is read-only and is generated by the system. If the system made the last update, the value is "AAAAAAAAAA". description: Response body returned when the Create SLO operation (POST /slo) successfully creates an SLO. examples: example: value: created: 1556825430000 creator: AAXYAAAAAZ3 description: My SLO test id: FrvcMakAAAA inputs: goodEventsLabel: A programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' totalEventsLabel: B lastUpdated: 1556825430000 lastUpdatedBy: AAXYAAAAAZ3 metadata: - sf_sloMetricName:spans.count - sf_service:* name: Test SLO targets: - compliancePeriod: 30d slo: 99.99 sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email - channel: slack_channel credentialId: AAAAAAAABLw type: Slack parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - email: test@gmail.com type: Email parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE type: RollingWindow type: RequestBased '400': description: HTTP 400 response content: application/json: schema: type: object example: code: 400 message: At least one SLO target is required examples: example: value: code: 400 message: At least one SLO target is required '401': description: HTTP 401 response content: application/json: schema: type: object example: code: 401 message: No session is active, or caller doesn't have access to requested organization examples: example: value: code: 401 message: No session is active, or caller doesn't have access to requested organization '403': description: HTTP 403 response content: application/json: schema: type: object example: code: 403 message: User is not authorized for this operation examples: example: value: code: 403 message: User is not authorized for this operation security: - SessionToken: [] tags: - SLOs /slo/{id}: get: summary: Retrieve SLO ID description: Retrieves the properties of the SLO that has the ID specified in the {id} path parameter. parameters: - name: id in: path description: ID for the SLO you want to retrieve required: true schema: type: string example: FrvcMakAAAA - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Get SLO Reponse Body type: object properties: created: title: SLO creation time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time the SLO was created in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. creator: title: Creator user ID type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who created this SLO. This property is read-only and is generated by the system. id: title: ID of the SLO type: string readOnly: true example: FrvcMakAAAA description: ID of the SLO. This property is read-only and is generated by the system. description: title: Description of the SLO type: string example: My SLO test description: Description of the SLO name: title: Name of the SLO type: string example: Test SLO description: Name of the SLO. Each SLO name must be unique within an organization type: title: Type of SLO type: string enum: - RequestBased description: 'Type of the SLO. You can configure your SLO as the following type: Request-based SLO: Measurement tracks the successful request count and total request count' inputs: title: SLO inputs oneOf: - title: Request Based Input SLO Type type: object required: - programText - totalEventsLabel - goodEventsLabel properties: programText: type: string example: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' description: SignalFlow program and arguments text strings that define the streams used as successful event count and total event count totalEventsLabel: type: string example: B description: Label used in programText that refers to the data block which contains the stream of total events goodEventsLabel: type: string example: A description: Label used in programText that refers to the data block which contains the stream of successful events description: Properties to congifure an SLO object configured request-based inputs example: programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' goodEventsLabel: A totalEventsLabel: B description: Inputs to configure your SLO targets: title: SLO target array type: array minItems: 1 maxItems: 1 items: title: SLO Target type: object required: - compliancePeriod - cycleType - cycleStart - slo - type - sloAlertRules properties: compliancePeriod: type: string example: 30d description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d (30 days), inclusive. cycleType: type: string enum: - week - month example: week description: 'Cycle type for this SLO target, either week or month. Note: Required only when SLO target type is CalendarWindow.' cycleStart: type: string example: monday description: 'Starting point for the cycle of this SLO target. For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday, and so on. For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive. Note: Required only when SLO target type is CalendarWindow.' slo: type: number format: double minimum: 0 exclusiveMinimum: true exclusiveMaximum: true maximum: 100 example: 99.99 description: Target value in the form of a percentage type: type: string enum: - RollingWindow - CalendarWindow example: RollingWindow description: 'SLO target can be the following type: RollingWindow CalendarWindow' sloAlertRules: type: array items: title: SLO Alert Rule Object type: object required: - type - rules properties: type: type: string enum: - BREACH - ERROR_BUDGET_LEFT - BURN_RATE example: BREACH description: 'SLO alert rule can be one of the following types: BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified compliance window. ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage of the estimated error budget for the compliance window. BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy threshold for the specified compliance window. Note: Within an SLO object, you can only specify one SLO alert rule per type. For example, you can''t specify two objects of type BREACH in the same sloAlertRules list.' alertsTriggered: type: boolean readOnly: true default: false description: When the system sets this to true, there is at least one active alert for this SLO alert rule rules: type: array items: title: SLO Alert Rule Object type: object required: - severity properties: description: type: string example: Alert when the target has been breached for 5 minutes description: Description for the rule detectLabel: type: string example: label disabled: type: boolean default: false example: false description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from an SLO alert to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a an SLO alert notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string readOnly: false writeOnly: false description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. Prerequisits to send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tAlert rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tAlert rule\ \ \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\" cleared at {{dateTimeFormat timestamp\ \ format=\"full\"}}.\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n\ {{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{ruleName}}} in SLO {{{sloName}}} description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check the SLO in Splunk Observability Cloud parameters: title: Parameters for SLO alert rule type: object properties: fireLasting: type: string default: 5m example: 5m description: 'Duration that indicates how long the alert condition is met before the alert is triggered. The value must be positive and smaller than the compliance period of the SLO target. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the fireLasting parameter.' percentOfLasting: type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 100 example: 100 description: 'Percentage of the fireLasting duration that the alert condition is met before the alert is triggered. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the percentOfLasting parameter' percentErrorBudgetLeft: title: Percent Error Budget Left Parameter type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 10 example: 10 description: 'Error budget must be equal to or smaller than this percentage for the alert to be triggered. Note: ERROR_BUDGET_LEFT alert rules use the percentErrorBudgetLeft parameter' shortWindow1: title: Short Window 1 Parameter nullable: false type: string default: 5m example: 5m description: 'Short window 1 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow1. Note: BURN_RATE alert rules use the shortWindow1 parameter' longWindow1: title: Long Window 1 Parameter nullable: false type: string default: 1h example: 1h description: 'Long window 1 used in burn rate alert calculation. This value must be longer than shortWindow1 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow1 parameter' shortWindow2: title: Short Window 2 Parameter nullable: false type: string default: 30m example: 30m description: 'Short window 2 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow2. Note: shortWindow2 parameter is used only in BURN_RATE alert rules.' longWindow2: title: Long Window 2 Parameter nullable: false type: string default: 6h example: 6h description: 'Long window 2 used in burn rate alert calculation. This value must be longer than shortWindow2 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow2 parameter' burnRateThreshold1: title: Burn Rate Threshold 1 Parameter nullable: false type: number format: double example: 14.4 description: 'Burn rate threshold 1 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold1 parameter' burnRateThreshold2: title: Burn Rate Threshold 2 Parameter nullable: false type: number format: double example: 6 description: 'Burn rate threshold 2 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold2 parameter' description: Parameters for the SLO alert rule in the form of a JSON object. Each SLO alert rule type accepts different parameters. If not specified, default parameters are used. description: Single SLO alert rule maxItems: 1 minItems: 1 description: List of rules in the form of a JSON array. Each element is a single alert rule object. description: Properties of an SLO alert rule object maxItems: 3 minItems: 1 description: 'List of alert rules you want to set for this SLO target in the form of a JSON array. Each element is a single SLO target alert rule. Note: An SLO alert rule of type BREACH is always required.' description: Properties of an SLO target object example: - compliancePeriod: 30d slo: 99.99 type: RollingWindow sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com - type: Slack channel: slack_channel credentialId: AAAAAAAABLw parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - type: Email email: test@gmail.com parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE description: List of targets you want to set for your SLO in the form of a JSON array. Each element is a single SLO target. metadata: title: SLO Metadata type: array items: type: string readOnly: true example: - sf_sloMetricName:spans.count - sf_service:* description: Read-only metadata of this SLO, set by the system based on the inputs property. lastUpdated: title: SLO last updated time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time when this SLO was last udpated, in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. lastUpdatedBy: title: User who last updated this SLO type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who last updated this SLO. This property is read-only and is generated by the system. If the system made the last update, the value is "AAAAAAAAAA". description: Properties of the SLO retrieved by a successful GET /slo/{id} in the form of a JSON object. examples: example: value: created: 1556825430000 creator: AAXYAAAAAZ3 description: My SLO test id: FrvcMakAAAA inputs: goodEventsLabel: A programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' totalEventsLabel: B lastUpdated: 1556825430000 lastUpdatedBy: AAXYAAAAAZ3 metadata: - sf_sloMetricName:spans.count - sf_service:* name: Test SLO targets: - compliancePeriod: 30d slo: 99.99 sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email - channel: slack_channel credentialId: AAAAAAAABLw type: Slack parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - email: test@gmail.com type: Email parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE type: RollingWindow type: RequestBased '401': description: HTTP 401 response content: application/json: schema: type: object example: code: 401 message: No session is active, or caller doesn't have access to requested organization examples: example: value: code: 401 message: No session is active, or caller doesn't have access to requested organization '403': description: HTTP 403 response content: application/json: schema: type: object example: code: 403 message: User is not authorized for this operation examples: example: value: code: 403 message: User is not authorized for this operation '404': description: HTTP 404 response content: application/json: schema: type: object example: code: 404 message: SLO not found examples: example: value: code: 404 message: SLO not found security: - SessionToken: [] tags: - SLOs put: summary: Update Existing SLO description: 'Updates the SLO for the ID specified in the {id} path parameter. The PUT /slo/{id} operation has overwrite semantics: For read-write properties, if the value is already specified, a new value in the request body overwrites it. For read-write properties, if the value is already specified, and you don''t modify it, the API updates the property with the default value. For example, if you don''t provide values for description, the updated SLO has an empty array for description. Because of these semantics, follow these steps to explicitly preserve existing values: Send a GET /slo/{id} request to retrieve the existing SLO property values. Update any read-write properties in the response body with the new values you want to use. Use the response body as the request body in the PUT /slo/{id} operation to update the SLO.' parameters: - name: id in: path description: ID of the SLO you want to update required: true schema: type: string - name: Content-Type in: header description: Request body format. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string requestBody: required: true content: application/json: schema: title: Update SLO Request Body type: object required: - name - type - inputs - targets properties: description: title: Description of the SLO type: string example: My SLO test description: Description of the SLO name: title: Name of the SLO type: string example: Test SLO description: Name of the SLO. Each SLO name must be unique within an organization type: title: Type of SLO type: string enum: - RequestBased description: 'Type of the SLO. You can configure your SLO as the following type: Request-based SLO: Measurement tracks the successful request count and total request count' inputs: title: SLO inputs oneOf: - title: Request Based Input SLO Type type: object required: - programText - totalEventsLabel - goodEventsLabel properties: programText: type: string example: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' description: SignalFlow program and arguments text strings that define the streams used as successful event count and total event count totalEventsLabel: type: string example: B description: Label used in programText that refers to the data block which contains the stream of total events goodEventsLabel: type: string example: A description: Label used in programText that refers to the data block which contains the stream of successful events description: Properties to congifure an SLO object configured request-based inputs example: programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' goodEventsLabel: A totalEventsLabel: B description: Inputs to configure your SLO targets: title: SLO target array type: array minItems: 1 maxItems: 1 items: title: SLO Target type: object required: - compliancePeriod - cycleType - cycleStart - slo - type - sloAlertRules properties: compliancePeriod: type: string example: 30d description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d (30 days), inclusive. cycleType: type: string enum: - week - month example: week description: 'Cycle type for this SLO target, either week or month. Note: Required only when SLO target type is CalendarWindow.' cycleStart: type: string example: monday description: 'Starting point for the cycle of this SLO target. For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday, and so on. For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive. Note: Required only when SLO target type is CalendarWindow.' slo: type: number format: double minimum: 0 exclusiveMinimum: true exclusiveMaximum: true maximum: 100 example: 99.99 description: Target value in the form of a percentage type: type: string enum: - RollingWindow - CalendarWindow example: RollingWindow description: 'SLO target can be the following type: RollingWindow CalendarWindow' sloAlertRules: type: array items: title: SLO Alert Rule Object type: object required: - type - rules properties: type: type: string enum: - BREACH - ERROR_BUDGET_LEFT - BURN_RATE example: BREACH description: 'SLO alert rule can be one of the following types: BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified compliance window. ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage of the estimated error budget for the compliance window. BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy threshold for the specified compliance window. Note: Within an SLO object, you can only specify one SLO alert rule per type. For example, you can''t specify two objects of type BREACH in the same sloAlertRules list.' alertsTriggered: type: boolean readOnly: true default: false description: When the system sets this to true, there is at least one active alert for this SLO alert rule rules: type: array items: title: SLO Alert Rule Object type: object required: - severity properties: description: type: string example: Alert when the target has been breached for 5 minutes description: Description for the rule detectLabel: type: string example: label disabled: type: boolean default: false example: false description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from an SLO alert to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a an SLO alert notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string readOnly: false writeOnly: false description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. Prerequisits to send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tAlert rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tAlert rule\ \ \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\" cleared at {{dateTimeFormat timestamp\ \ format=\"full\"}}.\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n\ {{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{ruleName}}} in SLO {{{sloName}}} description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check the SLO in Splunk Observability Cloud parameters: title: Parameters for SLO alert rule type: object properties: fireLasting: type: string default: 5m example: 5m description: 'Duration that indicates how long the alert condition is met before the alert is triggered. The value must be positive and smaller than the compliance period of the SLO target. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the fireLasting parameter.' percentOfLasting: type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 100 example: 100 description: 'Percentage of the fireLasting duration that the alert condition is met before the alert is triggered. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the percentOfLasting parameter' percentErrorBudgetLeft: title: Percent Error Budget Left Parameter type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 10 example: 10 description: 'Error budget must be equal to or smaller than this percentage for the alert to be triggered. Note: ERROR_BUDGET_LEFT alert rules use the percentErrorBudgetLeft parameter' shortWindow1: title: Short Window 1 Parameter nullable: false type: string default: 5m example: 5m description: 'Short window 1 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow1. Note: BURN_RATE alert rules use the shortWindow1 parameter' longWindow1: title: Long Window 1 Parameter nullable: false type: string default: 1h example: 1h description: 'Long window 1 used in burn rate alert calculation. This value must be longer than shortWindow1 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow1 parameter' shortWindow2: title: Short Window 2 Parameter nullable: false type: string default: 30m example: 30m description: 'Short window 2 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow2. Note: shortWindow2 parameter is used only in BURN_RATE alert rules.' longWindow2: title: Long Window 2 Parameter nullable: false type: string default: 6h example: 6h description: 'Long window 2 used in burn rate alert calculation. This value must be longer than shortWindow2 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow2 parameter' burnRateThreshold1: title: Burn Rate Threshold 1 Parameter nullable: false type: number format: double example: 14.4 description: 'Burn rate threshold 1 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold1 parameter' burnRateThreshold2: title: Burn Rate Threshold 2 Parameter nullable: false type: number format: double example: 6 description: 'Burn rate threshold 2 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold2 parameter' description: Parameters for the SLO alert rule in the form of a JSON object. Each SLO alert rule type accepts different parameters. If not specified, default parameters are used. description: Single SLO alert rule maxItems: 1 minItems: 1 description: List of rules in the form of a JSON array. Each element is a single alert rule object. description: Properties of an SLO alert rule object maxItems: 3 minItems: 1 description: 'List of alert rules you want to set for this SLO target in the form of a JSON array. Each element is a single SLO target alert rule. Note: An SLO alert rule of type BREACH is always required.' description: Properties of an SLO target object example: - compliancePeriod: 30d slo: 99.99 type: RollingWindow sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com - type: Slack channel: slack_channel credentialId: AAAAAAAABLw parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - type: Email email: test@gmail.com parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE description: List of targets you want to set for your SLO in the form of a JSON array. Each element is a single SLO target. description: Properties you can overwrite in an Update SLO operation examples: example: value: description: My SLO test inputs: goodEventsLabel: A programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' totalEventsLabel: B name: Test SLO targets: - compliancePeriod: 30d slo: 99.99 sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email - channel: slack_channel credentialId: AAAAAAAABLw type: Slack parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - email: test@gmail.com type: Email parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE type: RollingWindow type: RequestBased responses: '200': description: HTTP 200 response content: application/json: schema: title: Update SLO Response Body type: object properties: created: title: SLO creation time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time the SLO was created in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. creator: title: Creator user ID type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who created this SLO. This property is read-only and is generated by the system. id: title: ID of the SLO type: string readOnly: true example: FrvcMakAAAA description: ID of the SLO. This property is read-only and is generated by the system. description: title: Description of the SLO type: string example: My SLO test description: Description of the SLO name: title: Name of the SLO type: string example: Test SLO description: Name of the SLO. Each SLO name must be unique within an organization type: title: Type of SLO type: string enum: - RequestBased description: 'Type of the SLO. You can configure your SLO as the following type: Request-based SLO: Measurement tracks the successful request count and total request count' inputs: title: SLO inputs oneOf: - title: Request Based Input SLO Type type: object required: - programText - totalEventsLabel - goodEventsLabel properties: programText: type: string example: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' description: SignalFlow program and arguments text strings that define the streams used as successful event count and total event count totalEventsLabel: type: string example: B description: Label used in programText that refers to the data block which contains the stream of total events goodEventsLabel: type: string example: A description: Label used in programText that refers to the data block which contains the stream of successful events description: Properties to congifure an SLO object configured request-based inputs example: programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' goodEventsLabel: A totalEventsLabel: B description: Inputs to configure your SLO targets: title: SLO target array type: array minItems: 1 maxItems: 1 items: title: SLO Target type: object required: - compliancePeriod - cycleType - cycleStart - slo - type - sloAlertRules properties: compliancePeriod: type: string example: 30d description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d (30 days), inclusive. cycleType: type: string enum: - week - month example: week description: 'Cycle type for this SLO target, either week or month. Note: Required only when SLO target type is CalendarWindow.' cycleStart: type: string example: monday description: 'Starting point for the cycle of this SLO target. For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday, and so on. For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive. Note: Required only when SLO target type is CalendarWindow.' slo: type: number format: double minimum: 0 exclusiveMinimum: true exclusiveMaximum: true maximum: 100 example: 99.99 description: Target value in the form of a percentage type: type: string enum: - RollingWindow - CalendarWindow example: RollingWindow description: 'SLO target can be the following type: RollingWindow CalendarWindow' sloAlertRules: type: array items: title: SLO Alert Rule Object type: object required: - type - rules properties: type: type: string enum: - BREACH - ERROR_BUDGET_LEFT - BURN_RATE example: BREACH description: 'SLO alert rule can be one of the following types: BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified compliance window. ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage of the estimated error budget for the compliance window. BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy threshold for the specified compliance window. Note: Within an SLO object, you can only specify one SLO alert rule per type. For example, you can''t specify two objects of type BREACH in the same sloAlertRules list.' alertsTriggered: type: boolean readOnly: true default: false description: When the system sets this to true, there is at least one active alert for this SLO alert rule rules: type: array items: title: SLO Alert Rule Object type: object required: - severity properties: description: type: string example: Alert when the target has been breached for 5 minutes description: Description for the rule detectLabel: type: string example: label disabled: type: boolean default: false example: false description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from an SLO alert to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a an SLO alert notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string readOnly: false writeOnly: false description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. Prerequisits to send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tAlert rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tAlert rule\ \ \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\" cleared at {{dateTimeFormat timestamp\ \ format=\"full\"}}.\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n\ {{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{ruleName}}} in SLO {{{sloName}}} description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check the SLO in Splunk Observability Cloud parameters: title: Parameters for SLO alert rule type: object properties: fireLasting: type: string default: 5m example: 5m description: 'Duration that indicates how long the alert condition is met before the alert is triggered. The value must be positive and smaller than the compliance period of the SLO target. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the fireLasting parameter.' percentOfLasting: type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 100 example: 100 description: 'Percentage of the fireLasting duration that the alert condition is met before the alert is triggered. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the percentOfLasting parameter' percentErrorBudgetLeft: title: Percent Error Budget Left Parameter type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 10 example: 10 description: 'Error budget must be equal to or smaller than this percentage for the alert to be triggered. Note: ERROR_BUDGET_LEFT alert rules use the percentErrorBudgetLeft parameter' shortWindow1: title: Short Window 1 Parameter nullable: false type: string default: 5m example: 5m description: 'Short window 1 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow1. Note: BURN_RATE alert rules use the shortWindow1 parameter' longWindow1: title: Long Window 1 Parameter nullable: false type: string default: 1h example: 1h description: 'Long window 1 used in burn rate alert calculation. This value must be longer than shortWindow1 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow1 parameter' shortWindow2: title: Short Window 2 Parameter nullable: false type: string default: 30m example: 30m description: 'Short window 2 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow2. Note: shortWindow2 parameter is used only in BURN_RATE alert rules.' longWindow2: title: Long Window 2 Parameter nullable: false type: string default: 6h example: 6h description: 'Long window 2 used in burn rate alert calculation. This value must be longer than shortWindow2 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow2 parameter' burnRateThreshold1: title: Burn Rate Threshold 1 Parameter nullable: false type: number format: double example: 14.4 description: 'Burn rate threshold 1 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold1 parameter' burnRateThreshold2: title: Burn Rate Threshold 2 Parameter nullable: false type: number format: double example: 6 description: 'Burn rate threshold 2 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold2 parameter' description: Parameters for the SLO alert rule in the form of a JSON object. Each SLO alert rule type accepts different parameters. If not specified, default parameters are used. description: Single SLO alert rule maxItems: 1 minItems: 1 description: List of rules in the form of a JSON array. Each element is a single alert rule object. description: Properties of an SLO alert rule object maxItems: 3 minItems: 1 description: 'List of alert rules you want to set for this SLO target in the form of a JSON array. Each element is a single SLO target alert rule. Note: An SLO alert rule of type BREACH is always required.' description: Properties of an SLO target object example: - compliancePeriod: 30d slo: 99.99 type: RollingWindow sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com - type: Slack channel: slack_channel credentialId: AAAAAAAABLw parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - type: Email email: test@gmail.com parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE description: List of targets you want to set for your SLO in the form of a JSON array. Each element is a single SLO target. metadata: title: SLO Metadata type: array items: type: string readOnly: true example: - sf_sloMetricName:spans.count - sf_service:* description: Read-only metadata of this SLO, set by the system based on the inputs property. lastUpdated: title: SLO last updated time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time when this SLO was last udpated, in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. lastUpdatedBy: title: User who last updated this SLO type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who last updated this SLO. This property is read-only and is generated by the system. If the system made the last update, the value is "AAAAAAAAAA". description: Response body returned when the Update SLO operation (PUT /slo/{id}) successfully updates an SLO. examples: example: value: created: 1556825430000 creator: AAXYAAAAAZ3 description: My SLO test id: FrvcMakAAAA inputs: goodEventsLabel: A programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' totalEventsLabel: B lastUpdated: 1556825430000 lastUpdatedBy: AAXYAAAAAZ3 metadata: - sf_sloMetricName:spans.count - sf_service:* name: Test SLO targets: - compliancePeriod: 30d slo: 99.99 sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email - channel: slack_channel credentialId: AAAAAAAABLw type: Slack parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - email: test@gmail.com type: Email parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE type: RollingWindow type: RequestBased '400': description: HTTP 400 response content: application/json: schema: type: object example: code: 400 message: SLO name must be defined examples: example: value: code: 400 message: SLO name must be defined '401': description: HTTP 401 response content: application/json: schema: type: object example: code: 401 message: No session is active, or caller doesn't have access to requested organization examples: example: value: code: 401 message: No session is active, or caller doesn't have access to requested organization '403': description: HTTP 403 response content: application/json: schema: type: object example: code: 403 message: User is not authorized for this operation examples: example: value: code: 403 message: User is not authorized for this operation '404': description: HTTP 404 response content: application/json: schema: type: object example: code: 404 message: SLO not found examples: example: value: code: 404 message: SLO not found security: - SessionToken: [] tags: - SLOs delete: summary: Delete SLO ID description: Deletes the SLO that has the ID specified in the {id} path parameter. parameters: - name: id in: path description: ID of the SLO you want to delete required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string responses: '204': description: HTTP 204 response content: application/json: schema: type: object example: code: 204 message: Successfully deleted SLO examples: example: value: code: 204 message: Successfully deleted SLO '401': description: HTTP 401 response content: application/json: schema: type: object example: code: 401 message: No session is active, or caller doesn't have access to requested organization examples: example: value: code: 401 message: No session is active, or caller doesn't have access to requested organization '403': description: HTTP 403 response content: application/json: schema: type: object example: code: 403 message: User is not authorized for this operation examples: example: value: code: 403 message: User is not authorized for this operation '404': description: HTTP 404 response content: application/json: schema: type: object example: code: 404 message: SLO not found examples: example: value: code: 404 message: SLO not found security: - SessionToken: [] tags: - SLOs /slo/search: post: summary: Search SLO description: 'Search for SLOs by name, ID, metadata, or alert status. Note: You only need one of the listed request body parameters for your search SLO request to be valid.' parameters: - name: limit in: query description: 'Number of SLOs to retrieve from the list of SLOs that match your search criteria. When used togeter, the offset and limit properties provide paged access to the query results. You can repeatedly download small slices of a large query result, which helps you avoid bandwidth and performance.' schema: type: integer format: int32 default: 50 example: 10 minimum: 0 maximum: 10000 - name: offset in: query description: 'Index of the SLO object you want to use as the starting point for the result set. When used togeter, the offset and limit properties provide paged access to the query results. You can repeatedly download small slices of a large query result, which helps you avoid bandwidth and performance.' schema: type: integer format: int32 default: 0 minimum: 0 example: 10 - name: orderBy in: query description: 'List of criteria by which to sort the returned result set. You can use the following fields: name description creator created lastUpdated lastUpdatedBy breachAlertsTriggered errorBudgetLeftAlertsTriggered burnRateAlertsTriggered Include a dash ( - ) before a criterion to indicate a descending sort order. The default sorting criterion is -lastUpdated, which means the result list is sorted from most recently updated to least recently updated.' schema: type: array items: type: string default: - -lastUpdated example: - name - name: Content-Type in: header description: Request body format. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string requestBody: required: true content: application/json: schema: title: Search SLO Request Body type: object properties: name: title: SLO name type: string example: Test SLO description: Name of the SLO you want to search for. The API matches this value to the name property of exisiting SLOs. The match can be full or partial. sloIds: title: SLO IDs type: array minItems: 1 items: type: string example: - EU61I2AAEdA - EU61I7AAEdA description: IDs of the SLOs you want to search for metadata: title: SLO metadata type: array items: type: array uniqueItems: true items: type: string example: - - sf_service:* breachAlertsTriggered: title: Breach alerts triggered type: boolean default: false example: true description: Set to true to search for SLOs with active breach incidents. errorBudgetLeftAlertsTriggered: title: Error budget alerts triggered type: boolean default: false example: true description: Set to true to search for SLOs with active error budget left incidents. burnRateAlertsTriggered: title: Burn rate alerts triggered type: boolean default: false example: true description: Set to true to search for SLOs with active burn rate incidents. description: Properties used to search for SLOs using the API. examples: example: value: breachAlertsTriggered: true burnRateAlertsTriggered: true errorBudgetLeftAlertsTriggered: true metadata: - - sf_service:* name: Test SLO sloIds: - EU61I2AAEdA - EU61I7AAEdA responses: '200': description: HTTP 200 response content: application/json: schema: title: Search SLO Response Body type: object properties: count: type: integer format: int32 example: 1 description: 'Number of SLO objects matching the provided search criteria. Note: This value is the total number of matches, not the number of SLOs returned. The number of SLOs that the system returns is affected by the limit and offset query parameters. In summary: sizeOf(results): Number of SLO objets returned in the response body. count: Number of SLO objects matcing the search criteria.' results: type: array items: title: Service Level Objective Object type: object properties: created: title: SLO creation time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time the SLO was created in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. creator: title: Creator user ID type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who created this SLO. This property is read-only and is generated by the system. id: title: ID of the SLO type: string readOnly: true example: FrvcMakAAAA description: ID of the SLO. This property is read-only and is generated by the system. description: title: Description of the SLO type: string example: My SLO test description: Description of the SLO name: title: Name of the SLO type: string example: Test SLO description: Name of the SLO. Each SLO name must be unique within an organization type: title: Type of SLO type: string enum: - RequestBased description: 'Type of the SLO. You can configure your SLO as the following type: Request-based SLO: Measurement tracks the successful request count and total request count' inputs: title: SLO inputs oneOf: - title: Request Based Input SLO Type type: object required: - programText - totalEventsLabel - goodEventsLabel properties: programText: type: string example: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' description: SignalFlow program and arguments text strings that define the streams used as successful event count and total event count totalEventsLabel: type: string example: B description: Label used in programText that refers to the data block which contains the stream of total events goodEventsLabel: type: string example: A description: Label used in programText that refers to the data block which contains the stream of successful events description: Properties to congifure an SLO object configured request-based inputs example: programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' goodEventsLabel: A totalEventsLabel: B description: Inputs to configure your SLO targets: title: SLO target array type: array minItems: 1 maxItems: 1 items: title: SLO Target type: object required: - compliancePeriod - cycleType - cycleStart - slo - type - sloAlertRules properties: compliancePeriod: type: string example: 30d description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d (30 days), inclusive. cycleType: type: string enum: - week - month example: week description: 'Cycle type for this SLO target, either week or month. Note: Required only when SLO target type is CalendarWindow.' cycleStart: type: string example: monday description: 'Starting point for the cycle of this SLO target. For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday, and so on. For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive. Note: Required only when SLO target type is CalendarWindow.' slo: type: number format: double minimum: 0 exclusiveMinimum: true exclusiveMaximum: true maximum: 100 example: 99.99 description: Target value in the form of a percentage type: type: string enum: - RollingWindow - CalendarWindow example: RollingWindow description: 'SLO target can be the following type: RollingWindow CalendarWindow' sloAlertRules: type: array items: title: SLO Alert Rule Object type: object required: - type - rules properties: type: type: string enum: - BREACH - ERROR_BUDGET_LEFT - BURN_RATE example: BREACH description: 'SLO alert rule can be one of the following types: BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified compliance window. ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage of the estimated error budget for the compliance window. BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy threshold for the specified compliance window. Note: Within an SLO object, you can only specify one SLO alert rule per type. For example, you can''t specify two objects of type BREACH in the same sloAlertRules list.' alertsTriggered: type: boolean readOnly: true default: false description: When the system sets this to true, there is at least one active alert for this SLO alert rule rules: type: array items: title: SLO Alert Rule Object type: object required: - severity properties: description: type: string example: Alert when the target has been breached for 5 minutes description: Description for the rule detectLabel: type: string example: label disabled: type: boolean default: false example: false description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from an SLO alert to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a an SLO alert notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string readOnly: false writeOnly: false description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. Prerequisits to send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tAlert rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tAlert\ \ rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\" cleared at {{dateTimeFormat\ \ timestamp format=\"full\"}}.\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook:\ \ {{{runbookUrl}}}{{/if}}\n{{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{ruleName}}} in SLO {{{sloName}}} description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check the SLO in Splunk Observability Cloud parameters: title: Parameters for SLO alert rule type: object properties: fireLasting: type: string default: 5m example: 5m description: 'Duration that indicates how long the alert condition is met before the alert is triggered. The value must be positive and smaller than the compliance period of the SLO target. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the fireLasting parameter.' percentOfLasting: type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 100 example: 100 description: 'Percentage of the fireLasting duration that the alert condition is met before the alert is triggered. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the percentOfLasting parameter' percentErrorBudgetLeft: title: Percent Error Budget Left Parameter type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 10 example: 10 description: 'Error budget must be equal to or smaller than this percentage for the alert to be triggered. Note: ERROR_BUDGET_LEFT alert rules use the percentErrorBudgetLeft parameter' shortWindow1: title: Short Window 1 Parameter nullable: false type: string default: 5m example: 5m description: 'Short window 1 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow1. Note: BURN_RATE alert rules use the shortWindow1 parameter' longWindow1: title: Long Window 1 Parameter nullable: false type: string default: 1h example: 1h description: 'Long window 1 used in burn rate alert calculation. This value must be longer than shortWindow1 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow1 parameter' shortWindow2: title: Short Window 2 Parameter nullable: false type: string default: 30m example: 30m description: 'Short window 2 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow2. Note: shortWindow2 parameter is used only in BURN_RATE alert rules.' longWindow2: title: Long Window 2 Parameter nullable: false type: string default: 6h example: 6h description: 'Long window 2 used in burn rate alert calculation. This value must be longer than shortWindow2 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow2 parameter' burnRateThreshold1: title: Burn Rate Threshold 1 Parameter nullable: false type: number format: double example: 14.4 description: 'Burn rate threshold 1 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold1 parameter' burnRateThreshold2: title: Burn Rate Threshold 2 Parameter nullable: false type: number format: double example: 6 description: 'Burn rate threshold 2 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold2 parameter' description: Parameters for the SLO alert rule in the form of a JSON object. Each SLO alert rule type accepts different parameters. If not specified, default parameters are used. description: Single SLO alert rule maxItems: 1 minItems: 1 description: List of rules in the form of a JSON array. Each element is a single alert rule object. description: Properties of an SLO alert rule object maxItems: 3 minItems: 1 description: 'List of alert rules you want to set for this SLO target in the form of a JSON array. Each element is a single SLO target alert rule. Note: An SLO alert rule of type BREACH is always required.' description: Properties of an SLO target object example: - compliancePeriod: 30d slo: 99.99 type: RollingWindow sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com - type: Slack channel: slack_channel credentialId: AAAAAAAABLw parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - type: Email email: test@gmail.com parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE description: List of targets you want to set for your SLO in the form of a JSON array. Each element is a single SLO target. metadata: title: SLO Metadata type: array items: type: string readOnly: true example: - sf_sloMetricName:spans.count - sf_service:* description: Read-only metadata of this SLO, set by the system based on the inputs property. lastUpdated: title: SLO last updated time type: integer format: int64 readOnly: true example: 1556825430000 description: Date and time when this SLO was last udpated, in the form of a *nix timestamp in milliseconds. This property is read-only and is generated by the system. lastUpdatedBy: title: User who last updated this SLO type: string readOnly: true example: AAXYAAAAAZ3 description: User ID of the user who last updated this SLO. This property is read-only and is generated by the system. If the system made the last update, the value is "AAAAAAAAAA". description: Properties of an SLO in the form of a JSON object. description: List of SLO objects matching the search criteria in the form of a JSON array. Each element is an SLO object. description: Response body returned when the Search SLO operation (POST /slo/search) successfully retrieves SLOs. examples: example: value: count: 1 results: - created: 1556825430000 creator: AAXYAAAAAZ3 description: My SLO test id: FrvcMakAAAA inputs: goodEventsLabel: A programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' totalEventsLabel: B lastUpdated: 1556825430000 lastUpdatedBy: AAXYAAAAAZ3 metadata: - sf_sloMetricName:spans.count - sf_service:* name: Test SLO targets: - compliancePeriod: 30d slo: 99.99 sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email - channel: slack_channel credentialId: AAAAAAAABLw type: Slack parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - email: test@gmail.com type: Email parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE type: RollingWindow type: RequestBased '400': description: HTTP 400 response content: application/json: schema: type: object example: code: 400 message: Limit must be greater than or equal to 0 examples: example: value: code: 400 message: Limit must be greater than or equal to 0 '401': description: HTTP 401 response content: application/json: schema: type: object example: code: 401 message: No session is active, or caller doesn't have access to requested organization examples: example: value: code: 401 message: No session is active, or caller doesn't have access to requested organization security: - SessionToken: [] tags: - SLOs /slo/validate: post: summary: Validate SLO Definition description: 'Checks an SLO request body to see if it''s valid, but doesn''t actually create an SLO. This operation doesn''t return a response body.' parameters: - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token required: true schema: type: string requestBody: required: true content: application/json: schema: title: Validate SLO Request Body type: object required: - name - type - inputs - targets properties: description: title: Description of the SLO type: string example: My SLO test description: Description of the SLO name: title: Name of the SLO type: string example: Test SLO description: Name of the SLO. Each SLO name must be unique within an organization type: title: Type of SLO type: string enum: - RequestBased description: 'Type of the SLO. You can configure your SLO as the following type: Request-based SLO: Measurement tracks the successful request count and total request count' inputs: title: SLO inputs oneOf: - title: Request Based Input SLO Type type: object required: - programText - totalEventsLabel - goodEventsLabel properties: programText: type: string example: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' description: SignalFlow program and arguments text strings that define the streams used as successful event count and total event count totalEventsLabel: type: string example: B description: Label used in programText that refers to the data block which contains the stream of total events goodEventsLabel: type: string example: A description: Label used in programText that refers to the data block which contains the stream of successful events description: Properties to congifure an SLO object configured request-based inputs example: programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' goodEventsLabel: A totalEventsLabel: B description: Inputs to configure your SLO targets: title: SLO target array type: array minItems: 1 maxItems: 1 items: title: SLO Target type: object required: - compliancePeriod - cycleType - cycleStart - slo - type - sloAlertRules properties: compliancePeriod: type: string example: 30d description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d (30 days), inclusive. cycleType: type: string enum: - week - month example: week description: 'Cycle type for this SLO target, either week or month. Note: Required only when SLO target type is CalendarWindow.' cycleStart: type: string example: monday description: 'Starting point for the cycle of this SLO target. For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday, and so on. For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive. Note: Required only when SLO target type is CalendarWindow.' slo: type: number format: double minimum: 0 exclusiveMinimum: true exclusiveMaximum: true maximum: 100 example: 99.99 description: Target value in the form of a percentage type: type: string enum: - RollingWindow - CalendarWindow example: RollingWindow description: 'SLO target can be the following type: RollingWindow CalendarWindow' sloAlertRules: type: array items: title: SLO Alert Rule Object type: object required: - type - rules properties: type: type: string enum: - BREACH - ERROR_BUDGET_LEFT - BURN_RATE example: BREACH description: 'SLO alert rule can be one of the following types: BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified compliance window. ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage of the estimated error budget for the compliance window. BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy threshold for the specified compliance window. Note: Within an SLO object, you can only specify one SLO alert rule per type. For example, you can''t specify two objects of type BREACH in the same sloAlertRules list.' alertsTriggered: type: boolean readOnly: true default: false description: When the system sets this to true, there is at least one active alert for this SLO alert rule rules: type: array items: title: SLO Alert Rule Object type: object required: - severity properties: description: type: string example: Alert when the target has been breached for 5 minutes description: Description for the rule detectLabel: type: string example: label disabled: type: boolean default: false example: false description: 'Controls the state of an alert rule. If false, the rule is turned on and SignalFlow issues alerts for it. If true, the rule is turned off and SignaFlow doesn''t issue alerts for it, even if one of the rules is triggered.' notifications: type: array readOnly: false writeOnly: false items: oneOf: - title: Amazon EventBridge Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string readOnly: false writeOnly: false description: 'Amazon EventBridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties needed to send a notification from an SLO alert to an existing Splunk Observability Cloud-to-Amazon EventBridge integration' - title: BigPanda Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string readOnly: false writeOnly: false description: 'BigPanda integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between BigPanda and Splunk Observability Cloud, in the form of a JSON object' - title: Email Alert Notification type: object required: - email - type properties: type: type: string readOnly: false writeOnly: false example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string readOnly: false writeOnly: false example: info@example.com description: 'The destination address for the notification email. Splunk Observability Cloud doesn''t validate this address, so you must ensure it''s correct before you use it. Splunk Observability Cloud may not store invalid values, and it may try to send notification email that doesn''t have an address. In either case, the notification won''t be delivered.' description: 'Specifies the properties of a notification service integration between email and Splunk Observability Cloud, in the form of a JSON object' - title: Jira Cloud or Jira Server Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON object. Jira alert notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. For more information, see the Integrate Jira with Splunk Observability Cloud topic in the Developers Guide.' - title: Microsoft Teams Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, this is always "Office365".' credentialId: readOnly: false writeOnly: false type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object' - title: Opsgenie Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns when you add the integration' credentialName: type: string readOnly: false writeOnly: false example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string readOnly: false writeOnly: false description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string readOnly: false writeOnly: false example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties of a an SLO alert notification sent via Opsgenie. - title: PagerDuty Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: readOnly: false writeOnly: false type: string description: 'PagerDuty integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between PagerDuty and Splunk Observability Cloud, in the form of a JSON object' - title: ServiceNow Alert Notification type: object required: - credentialId - type properties: type: type: string readOnly: false writeOnly: false example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string readOnly: false writeOnly: false description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between ServiceNow and Splunk Observability Cloud, in the form of a JSON object' - title: Slack Alert Notification type: object required: - type - channel - credentialId properties: type: type: string readOnly: false writeOnly: false example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string readOnly: false writeOnly: false example: channel-notifications description: 'The name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string readOnly: false writeOnly: false description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between Slack and Splunk Observability Cloud, in the form of a JSON object' - title: Team Email Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: TeamEmail description: 'Notification service to use for the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string readOnly: false writeOnly: false description: 'The ID of a team. All the members of this team receive an email containing the notification message. Splunk Observability Cloud uses the email address used to invite the member to the organization.' description: 'Properties of a notification service that sends an alert message email to each member of a team' - title: Team Notification type: object required: - type - team properties: type: type: string readOnly: false writeOnly: false example: Team description: 'Tells Splunk Observability Cloud which notification service to use to send the alert message. For the team notification service, this is always "Team".' team: type: string readOnly: false writeOnly: false example: DevOps description: 'The ID of a team. When a rule issues an alert message, Splunk Observability Cloud sends the message using one of notification services configured for the team''s notification policy. Splunk Observability Cloud uses the alert severity to determine the notification service to use. The team notification policy can specify a different service for each severity level as well as multiple services per level.' description: 'Properties of a notification service that sends an alert message to each member of a team, using the team''s notification policy' - title: Splunk On-Call Alert Notification type: object required: - type - credentialId - routingKey properties: type: type: string readOnly: false writeOnly: false example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string readOnly: false writeOnly: false description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' routingKey: type: string readOnly: false writeOnly: false description: 'Indicates the routing key used to determine how to process the notification message. This key specifies where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: 'Specifies the properties of a notification service integration between Splunk On-Call and Splunk Observability Cloud, in the form of a JSON object' - title: Webhook URL Alert Notification type: object required: - type properties: type: type: string readOnly: false writeOnly: false example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string readOnly: false writeOnly: false description: 'Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' secret: type: string readOnly: false writeOnly: false description: 'A secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If credentialId is set, this property is ignored.' url: type: string readOnly: false writeOnly: false description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: 'Specifies the properties of a notification service integration between a WebHook URL and Splunk Observability Cloud, in the form of a JSON object' - title: xMatters Alert Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (with a capital "X").' credentialId: type: string readOnly: false writeOnly: false description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId.' description: 'Specifies the properties of a notification service integration between xMatters and Splunk Observability Cloud, in the form of a JSON object' example: - email: user@example.com type: Email - credentialId: myCredentialId type: ServiceNow description: 'List of notifications to send when the rule is triggered, in the form of a JSON array. You can specify more than notification, and each of them can have a different type. Prerequisits to send email notifications: To send emails to a team, the team must already exist. For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. Email notes: "TeamEmail" sends the notification message to all of the team members, using the member''s email address. This email is the same as the one used to invite the member to the organization, and you can''t change it. "Team" sends notification messages using the team''s notification policy, which may or may not send email to team members. To learn more, see the description of the "Team" notification type.' parameterizedBody: type: string readOnly: false writeOnly: false example: "{{#if anomalous}}\n\tAlert rule \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\"\ \ triggered at {{dateTimeFormat timestamp format=\"full\"}}.\n{{else}}\n\tAlert rule\ \ \"{{{ruleName}}}\" in SLO \"{{{sloName}}}\" cleared at {{dateTimeFormat timestamp\ \ format=\"full\"}}.\n\n{{#if anomalous}}\n{{#if runbookUrl}}Runbook: {{{runbookUrl}}}{{/if}}\n\ {{#if tip}}Tip: {{{tip}}}{{/if}}\n{{/if}}" description: 'Custom notification message body for a rule, displayed in the alert notification. The body content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets "{}". To do partial escaping of the variable, enclose it in double curly brackets "{{}}". This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets "{{{}}}". Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about working with custom notification messages using the API, see Custom notification messages. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' parameterizedSubject: type: string readOnly: false writeOnly: false example: Notification for {{{ruleName}}} in SLO {{{sloName}}} description: 'Custom notification subject for a rule, displayed in the alert notification. The content must be plain text: Escape quote characters with a backslash Indicate a newline with the "\n" string. To insert an alert variable value, enclose the name in curly brackets {}. To do partial escaping of the variable, enclose it in double curly brackets {{}}. This ensures that characters in the body don''t trigger unintended results in Splunk Observability Cloud or the notification service. To do full escaping of the variable, enclose it in triple curly brackets {{{}}}. Splunk Observability Cloud escapes the variable as needed so that characters such as quotation marks and angle brackets render correctly. If you''re unsure which style of variable to use, use triple curly brackets, so that all content renders properly. Splunk Observability Cloud provides recommendations for the notation style to use with each supported variable. To learn more about custom notification messages in the API, see the API topics section Custom notification messages in the Developers Guide. To see a full list of variables with their default notation, see the section Message preview in the user documentation.' runbookUrl: type: string format: URL readOnly: false writeOnly: false example: www.example.com description: 'Provides a link from an alert rule to a runbook, in the form of a URL that you can refer to with the Splunk Observability Cloud {{runbookURL}} variable in the parameterizedBody or parameterizedSubject properties.' severity: type: string format: Capitalized enum: - Critical - Warning - Major - Minor - Info example: Info readOnly: false writeOnly: false description: 'Indicates the severity of a triggered alert. You can assign your own semantics to each severity level. To see the available values, refer to the enum specification. Note: The allowed values for Severity are enums, so you must enter them with the first letter in uppercase and all other letters lowercase. The PagerDuty alerting service maps Splunk Observability Cloud severity values to PagerDuty service values as follows (Splunk Observability Cloud values are at the beginning of the line): Critical → Critical Major → Critical Minor → Error Warning → Warning Info → Info' tip: title: Text that describes first action to take upon receiving an alert type: string example: Check the SLO in Splunk Observability Cloud parameters: title: Parameters for SLO alert rule type: object properties: fireLasting: type: string default: 5m example: 5m description: 'Duration that indicates how long the alert condition is met before the alert is triggered. The value must be positive and smaller than the compliance period of the SLO target. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the fireLasting parameter.' percentOfLasting: type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 100 example: 100 description: 'Percentage of the fireLasting duration that the alert condition is met before the alert is triggered. Note: BREACH and ERROR_BUDGET_LEFT alert rules use the percentOfLasting parameter' percentErrorBudgetLeft: title: Percent Error Budget Left Parameter type: number format: double minimum: 0 maximum: 100 exclusiveMinimum: true default: 10 example: 10 description: 'Error budget must be equal to or smaller than this percentage for the alert to be triggered. Note: ERROR_BUDGET_LEFT alert rules use the percentErrorBudgetLeft parameter' shortWindow1: title: Short Window 1 Parameter nullable: false type: string default: 5m example: 5m description: 'Short window 1 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow1. Note: BURN_RATE alert rules use the shortWindow1 parameter' longWindow1: title: Long Window 1 Parameter nullable: false type: string default: 1h example: 1h description: 'Long window 1 used in burn rate alert calculation. This value must be longer than shortWindow1 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow1 parameter' shortWindow2: title: Short Window 2 Parameter nullable: false type: string default: 30m example: 30m description: 'Short window 2 used in burn rate alert calculation. This value must be longer than 1/30 of longWindow2. Note: shortWindow2 parameter is used only in BURN_RATE alert rules.' longWindow2: title: Long Window 2 Parameter nullable: false type: string default: 6h example: 6h description: 'Long window 2 used in burn rate alert calculation. This value must be longer than shortWindow2 and shorter than 90 days. Note: BURN_RATE alert rules use the longWindow2 parameter' burnRateThreshold1: title: Burn Rate Threshold 1 Parameter nullable: false type: number format: double example: 14.4 description: 'Burn rate threshold 1 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold1 parameter' burnRateThreshold2: title: Burn Rate Threshold 2 Parameter nullable: false type: number format: double example: 6 description: 'Burn rate threshold 2 used in burn rate alert calculation. This value must be between 0 and 100/(100-SLO target). Note: BURN_RATE alert rules use the burnRateThreshold2 parameter' description: Parameters for the SLO alert rule in the form of a JSON object. Each SLO alert rule type accepts different parameters. If not specified, default parameters are used. description: Single SLO alert rule maxItems: 1 minItems: 1 description: List of rules in the form of a JSON array. Each element is a single alert rule object. description: Properties of an SLO alert rule object maxItems: 3 minItems: 1 description: 'List of alert rules you want to set for this SLO target in the form of a JSON array. Each element is a single SLO target alert rule. Note: An SLO alert rule of type BREACH is always required.' description: Properties of an SLO target object example: - compliancePeriod: 30d slo: 99.99 type: RollingWindow sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com - type: Slack channel: slack_channel credentialId: AAAAAAAABLw parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - type: Email email: test@gmail.com parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - type: Email email: user@gmail.com parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE description: List of targets you want to set for your SLO in the form of a JSON array. Each element is a single SLO target. description: Properties to use in validating a new SLO using the API examples: example: value: description: My SLO test inputs: goodEventsLabel: A programText: 'A = data(''spans.count'', filter(''sf_error'', ''false'')) B = data(''spans.count'') ' totalEventsLabel: B name: Test SLO targets: - compliancePeriod: 30d slo: 99.99 sloAlertRules: - rules: - description: Breach alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email - channel: slack_channel credentialId: AAAAAAAABLw type: Slack parameters: fireLasting: 3m severity: Major type: BREACH - rules: - description: Error budget rule detectLabel: label disabled: false notifications: - email: test@gmail.com type: Email parameters: fireLasting: 1m percentageErrorBudgetConsumed: 0.8 severity: Critical tip: tip type: ERROR_BUDGET_LEFT - rules: - description: Burn rate alert rule detectLabel: label disabled: false notifications: - email: user@gmail.com type: Email parameterizedBody: body parameterizedSubject: subject parameters: burnRateThreshold_1: 14.4 burnRateThreshold_2: 6 runbookUrl: example.com severity: Critical tip: tip type: BURN_RATE type: RollingWindow type: RequestBased responses: '204': description: HTTP 204 response '400': description: HTTP 400 response content: application/json: schema: type: object example: code: 400 message: At least one SLO target is required examples: example: value: code: 400 message: At least one SLO target is required security: - SessionToken: [] tags: - SLOs