topic Re: How to create Alert in Cloud version of Splunk in Splunk Cloud Platform

How to create Alert in Cloud version of Splunk

Evgeny197 — Thu, 27 Feb 2025 18:27:50 GMT

There is no option "Alert" when I try to "Save As" for current search. There is also no "Access Controls" in "Settings".

My final plan is to send alerts to Slack channels, but all the instructions I was able to find are for different versions of Splunk (Enterprise etc). Could someone point me in a right direction?

Thank you!

Re: How to create Alert in Cloud version of Splunk

marnall — Thu, 27 Feb 2025 20:24:58 GMT

Is the search a newly formed search or an edited Report? There should be an option for "Alert" when you make a new search and press "Save As", even in cloud.

Re: How to create Alert in Cloud version of Splunk

Evgeny197 — Thu, 27 Feb 2025 20:43:11 GMT

This is what I see

Re: How to create Alert in Cloud version of Splunk

Evgeny197 — Thu, 27 Feb 2025 20:43:43 GMT

It is a new search

Re: How to create Alert in Cloud version of Splunk

marnall — Thu, 27 Feb 2025 21:03:25 GMT

Are you able to check if your user has a role with the schedule_search capability?

Re: How to create Alert in Cloud version of Splunk

Evgeny197 — Thu, 27 Feb 2025 21:07:23 GMT

How can I check that? "Settings" does not have it it seems

Re: How to create Alert in Cloud version of Splunk

isoutamo — Fri, 28 Feb 2025 15:43:53 GMT

Obviously you have normal user role or some non power/admin user role.

In normal case only admin or power user can create and run alerts.

As @marnall said you must have correct capability to create alerts. You should ask that from your Splunk Admins which may give it to you or not. That depends on your company policy who can create and run those.

r. Ismo

Re: How to create Alert in Cloud version of Splunk

Evgeny197 — Fri, 28 Feb 2025 16:21:29 GMT

Hi Ismo,

Thank you! I came to that conclusion yesterday and contacted the admins.

Regards,

Evgeny

Re: How to create Alert in Cloud version of Splunk

isoutamo — Fri, 28 Feb 2025 16:29:24 GMT

Please mark some answer as Solution, so other people will see it later and get help!

Re: How to create Alert in Cloud version of Splunk

Evgeny197 — Tue, 04 Mar 2025 19:36:46 GMT

Hello Ismo,

I am able to create an alert, but it does not send the alerts to Slack.

I did check that the Slack Alert Setup has an updated "Slack App OAuth Token".

Are there any steps I am missing?

(By the way, if I chose email instead of Slack the alerts go through)

Re: How to create Alert in Cloud version of Splunk

isoutamo — Tue, 04 Mar 2025 20:48:55 GMT

I haven’t use slack alert action, so I just give general hints.
Usually alert actions are written some log what happened into _internal index you should try to found something which is related to it.