topic Re: Configure triggered alert expiration in Alerting

Configure triggered alert expiration

edwinmae — Tue, 08 May 2018 09:47:09 GMT

Hi,

Its probably somewhere but I can't see it (find it)

http://docs.splunk.com/Documentation/Splunk/6.6.3/Alert/Updatealerts

There is only the: Trigger Actions / Add Actions / e.g. Add to Triggered Alerts

But if default is 24h and I want to set it to e.g. 7 days, how do I do that?

Thanks in advance

/Edwin

Re: Configure triggered alert expiration

elliotproebstel — Tue, 08 May 2018 17:57:33 GMT

I believe this setting is controlled by the value set for ttl in alert_actions.conf. Here's an excerpt:

ttl     = <integer>[p]
* Optional argument specifying the minimum time to live (in seconds)
  of the search artifacts, if this action is triggered.
* If p follows integer, then integer is the number of scheduled periods.
* If no actions are triggered, the artifacts will have their ttl determined
  by the "dispatch.ttl" attribute in savedsearches.conf.
* Defaults to 10p
* Defaults to 86400 (24 hours)   for: email, rss
* Defaults to   600 (10 minutes) for: script
* Defaults to   120 (2 minutes)  for: summary_index, populate_lookup

Re: Configure triggered alert expiration

JordanPeterson — Tue, 08 May 2018 20:05:25 GMT

to build on this if you don't want to configure these in the .conf file they can be configured by select "Advanced Edit" when you edit the alert from the "Searches, Reports, and Alerts" page. You can then filter by ".ttl"

Re: Configure triggered alert expiration

edwinmae — Wed, 09 May 2018 04:26:40 GMT

I remember that in the 'past' this could be defined by editing the Alert. I believe that I found the related setting through Advanced Edit (Alert):

alert.expires

Re: Configure triggered alert expiration

markbarber21 — Fri, 12 Jul 2019 14:16:43 GMT

In 7.3, there is now an "Expires" field which can be set in the simple Edit Alert interface. The "Expires" value is only used to determine the TTL when using the "Add to Triggered Alerts" Action Type.

Re: Configure triggered alert expiration

lkeli_spl — Wed, 11 Dec 2019 13:16:51 GMT

In Splunk 7.*: Settings -> Searches, reports, and alerts -> Edit -> Advanced Edit -> alert.expires