Point 1: Impact 3, Urgency 3, Prio 5 --> no problem, can be achieved. Santi will let us know which value needs to be sent from LogStash/ELK to Splunk (if any) or if it can be hard coded directly in Splunk.
Point 2: CI is mandatory. Incident mgmt team could accept an exception, but this needs to be in written. CI can be sent each time from LogStash/ELK or can be set directly in Splunk
Point 3: Requirement GEP: set Category=Inquiries, Sub category= Generic Inquiries)Santi: we need to test it. Standard setting would be Category=Infrastructure, Sub category= Monitoring
Point 4: Requirement: errors will be grouped by LogStash/ELK and sent as one event. Each episode should have only one event.
Point 5: Support the initiative with testing and deployment