Here are a few tips on getting your nicely crafted alerts into Splunk using the Splunk-Solarwinds App.
While in Solarwinds you are accustomed to using Advanced alerts. The Splunk App pulls in the Orion.Events table, Alerts are a different table and aren't pulled in by default. Advanced alerts also don't have a reset event sent unless you query the database for them. To get around these limitations you can use the Orion.Events table fairly easily. First you will need to an alert action and reset action for each or your alerts 'Write to NetPerfMon Log'. When you add that action you can use the same wording and variables that you would normally add to an alert to make it cleanly readable. Once that alert action is added to both your alert/reset it will write the alert text into the Orion.Events table in the database.
To view those events in SWQL studio use a simple query like this.
SELECT TOP 1000 EventTime, EventType, Message, Acknowledged, Uri
FROM Orion.Events
--This will display Alerts and Resets
Where EventType LIKE '%5000%' OR EventType LIKE '%5001%'
ORDER BY EventTime DESC
The Event type 5000 is the alert and 5001 is the reset and are the events written by the alert into the Orion.events table from the 'Write to NetPerfMon Log' alert action from the Advanced alerts.
Now that your messages are being sent to Splunk you can craft you Splunk query to retrieve them.
