topic Re: Realtime email Alerts? in Alerting

Realtime email Alerts?

andrzejwasilews — Fri, 28 Jan 2011 22:34:25 GMT

Is it possible (or solution) to send email alert from splunk immediately when event occurs?

I would like to be informed "on event", not 1 munute later (1 minute is the minimal time range in search scheduler).

ziegfried — Fri, 28 Jan 2011 22:38:30 GMT

This is a feature that will be included in the upcoming Splunk 4.2 release.

cyfj — Mon, 07 Nov 2011 14:41:49 GMT

How that 4.2 is released, can you hint as to where to look? I'm only seeing periodic alerts bases on polling.

ftk — Mon, 07 Nov 2011 16:36:20 GMT

I thought this will be in 4.3?

BobM — Mon, 07 Nov 2011 17:10:08 GMT

No this is already available in 4.2

Create your search, select a real-time range (eg 1 minute window) then click 'create an alert'.

ftk — Mon, 07 Nov 2011 18:04:59 GMT

Nice. Thanks for the correction