R12.1 JA-2025July15
Runbook-based Triggered Automation
In this triggered automation, a map will be triggered with predefined runbooks, and URL of the created map to Splunk will be returned.
The following type of maps to be triggered from the Splunk are supported:
| Map Type | Description | Keyword for Map Type |
|---|---|---|
| NetworkBrain Automation - Device | Trigger map with a device and its neighbours. | Map URL — Neighbor |
| NetworkBrain Automation - Multi-Device | Trigger map with multiple devices and their neighbours. | Map URL — Multi_devices |
| NetworkBrain Automation - Site | Trigger a site map that the device belongs to. | Map URL — Site |
| NetworkBrain Automation - Path | Trigger path map. | Map URL — Path |
| NetworkBrain Automation - ACI | Trigger context map of ACI. | Map URL — Context |
| NetworkBrain Automation - Existing Map | Get the existing map. | Map URL — Existing |
The first step to create a runbook-triggered automation is to create an API Stub in NetworkBrain.
Steps Required from NetworkBrain End
- Navigate to Runbook-Based Triggered Automation > API Stub Manager tab. Click Add Stub to create an API stub.
- Select a map type (this should be same as the map type that is selected from the Splunk end) and runbook (which is optional).
Steps Required from Splunk End
- Create a new alert or edit an existing alert by navigating to the Alert tab in Splunk.
- Click Add Actions and then you will see a list of supported automations. Select NetBrain Automation - Device, which is the type of map that is to be created here.
- Define the following information based on the requirements.
Note: The API Stub name must be same as the stub name created in the NetworkBrain UI. 
Review the automation result in Splunk.
- Navigate to Search & Reporting.
- Search with the following search query and a time range that covers the alert triggering time.
- index=_internal sourcetype=splunkd "Map URL — Neighbor"
- (Optional) For easy access next time, save this search as a report and create a NetworkBrain dashboard.