topic Re: Alerts Triggered in Alerting

Alerts Triggered

HealyManTech — Wed, 14 Mar 2018 17:17:05 GMT

I have alerts setup that work but I cant use the email function or the script function to be able to see them when they happen. I am trying not to have to go to the trigger alerts page every time just to review the results. I would assume there is a way to get them to trigger in real time if I am using Splunk or at least have them in the message box for Splunk.

Can anyone help with this?

Re: Alerts Triggered

MousumiChowdhur — Thu, 15 Mar 2018 05:15:12 GMT

Hi!

I just want to know that do you want to see the alert results somewhere other than the alert triggered page?

Re: Alerts Triggered

p_gurav — Thu, 15 Mar 2018 05:43:49 GMT

Hi,

You can create report/dashboard with below search:

index=_audit action="alert_fired" | rename ss_name AS title 
 | join title [ | rest /services/saved/searches | table title, alert_threshold ] 
 | timechart values(alert_threshold) AS alert_threshold count by title

Re: Alerts Triggered

HealyManTech — Fri, 16 Mar 2018 12:18:31 GMT

I am thinking like a pop up or creating a dashboard for it.

Re: Alerts Triggered

MousumiChowdhur — Fri, 16 Mar 2018 12:24:07 GMT

Hi,

Actually you can create a dashboard whose search and time window will be same as that of your alert. This will help you see the alert result on a dashboard and you don't have to navigate to alert triggered page.

Thanks.

Re: Alerts Triggered

p_gurav — Fri, 16 Mar 2018 12:34:01 GMT

hey hi,
did you try this?

Re: Alerts Triggered

HealyManTech — Fri, 16 Mar 2018 16:01:40 GMT

I did but it wasn't what I was looking for. Thank you though.

Re: Alerts Triggered

HealyManTech — Fri, 16 Mar 2018 18:04:26 GMT

So if I have an alert that run every 5 mins it would update every 5 mins? But if I need to see previous results how would that be able to do that?

I saw that webhook is supposed to be able to create a popup does anyone have information on doing that?

Re: Alerts Triggered

MousumiChowdhur — Sat, 17 Mar 2018 03:24:30 GMT

Hi HealyManTech,

You can adjust the time span of the search in the dashboard panel according to the duration you would like to see the alert result for.

Also, webhook does let you make an alert message pop up. You can refer the below link which describes how to configure that.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Alert/Webhooks

Hope that helps you!

Thank you.

Re: Alerts Triggered

lguinn2 — Mon, 19 Mar 2018 05:34:50 GMT

In order for Splunk to send an email, Splunk must be able to connect to a valid email server with an appropriate user name (and password.) This is configured by the Splunk system admin; in the GUI, the email settings can be found under Settings >> Server settings >> Email settings

Re: Alerts Triggered

HealyManTech — Tue, 20 Mar 2018 13:20:45 GMT

Thank you for the answer. But the issue is I can't use the functions and wont be enabled do to the setup of the network resources and Splunk license. So I would need a different solution.