topic Re: Alerts Dashboard in Alerting

Alerts Dashboard

maayan — Wed, 10 Jan 2024 09:04:49 GMT

Hi,

i need to find a way to present all alerts in a dashboard(Classic/Studio). users don't want to get mail for each alert, they prefer to see (maybe in a table ) all the alerts in one page + the alert's last result.
and maybe to click on the alert and get the last search.

is it possible to create an alerts dashboard?

thanks,
Maayan

Re: Alerts Dashboard

gcusello — Wed, 10 Jan 2024 09:32:08 GMT

Hi @maayan,

did you explored the Alert Manager App (https://splunkbase.splunk.com/app/2665)?

Try it, I usually use it when I cannot use ES.

Put attention only to one point: the app can see only alerts with a Global sharing.

Ciao.

Giuseppe

Re: Alerts Dashboard

maayan — Wed, 10 Jan 2024 10:01:54 GMT

Hi,

Thanks! i will check. i dont have permission to install apps.
i wonder if there is an internal query to get all alerts and their results

Re: Alerts Dashboard

gcusello — Wed, 10 Jan 2024 10:42:46 GMT

Hi @maayan,

with this search you can list all the alerts

| rest splunk_server=local /servicesNS/-/-/saved/searches | where alert_type!="always" | table title

and with this search yu can list the fired alerts

Ciao.

Giuseppe

Re: Alerts Dashboard

maayan — Wed, 10 Jan 2024 13:07:18 GMT

Hi,

It's a very useful query!

| rest splunk_server=local /servicesNS/-/-/saved/searches | where alert_type!="always" | table title,author,description,"eai:acl.owner","next_scheduled_time","action.email.to"

I need the alerts results and the second query doesn't work for me. i have already created an alert and see in under the "Alerts" tab and scheduled in today.
What i need to change in the second query to results?
maybe something in the alert setting? or different index?

Re: Alerts Dashboard

maayan — Sun, 14 Jan 2024 09:22:17 GMT

we don't have permission to install the app. i will try to ask the infra team again.
is there an option to add the alert result to this query?

| rest splunk_server=local /servicesNS/-/-/saved/searches | where alert_type!="always" | table title,author,description,"eai:acl.owner","next_scheduled_time","action.email.to"