Run a search based on alert result

maada — Mon, 13 Aug 2018 12:24:01 GMT

Hi,
i would like to run a search (to collect data in a summary index) triggered by an alert, which is checking for new data. e.g. if the start of a new dataset comes in, i would like to enrich, manipulate and collect the last dataset into a summary index.

if the collect search only runs on a time schedule, i may get inconsistencies in between the collected dataset due to cutting in between.
i'm looking for something like a custom alert action to trigger another saved search.

Thanks in advance.

Re: Run a search based on alert result

DalJeanis — Tue, 14 Aug 2018 01:25:27 GMT

First possibility - look at @woodcock's answer to this question of how do you prevent a search from running during blackout periods.

https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html

You could apply a version of that solution.

Second possibility - you could use your first search to determine and return the earliest= and latest= times for your search that collects the data... and then set teh same arbitrary future date/time as both earliest and latest if your search determines there is no data.

topic Re: Run a search based on alert result in Splunk Dev

Run a search based on alert result

Re: Run a search based on alert result