https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501708#M8940 <P>Along the lines of your original idea to copy an event and modify it. You could do that and use <CODE>| collect</CODE> command to write it back to your index.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Collect">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Collect</A></P> Sat, 28 Mar 2020 00:11:44 GMT anthonymelita 2020-03-28T00:11:44Z https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501705#M8937 <P>I configured an alert when a VPN connection is established from an IP that is located abroad. Now I would like to test if the alert works as expected. What is the best way of doing this? Can I for example copy a raw VPN login event, change the source IP, mark the event as alerttestevent and add it to Splunk to test the alert? </P> <P>Can this be automated somehow, i.e. when I adjust an alert I want to easily retest that everything still works as expected? I'm thinking about something like unit tests for Splunk alerts.</P> Fri, 27 Mar 2020 13:39:46 GMT https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501705#M8937 spiced 2020-03-27T13:39:46Z https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501706#M8938 <P>You can use the Eventgen App to generate events. Take a look this might be your answer.<BR /> <A href="https://splunkbase.splunk.com/app/1924/">https://splunkbase.splunk.com/app/1924/</A></P> Fri, 27 Mar 2020 13:43:36 GMT https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501706#M8938 ckoltuk 2020-03-27T13:43:36Z https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501707#M8939 <P>Thank you for the response, I'll take a closer look at the Eventgen App.</P> Fri, 27 Mar 2020 14:44:09 GMT https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501707#M8939 spiced 2020-03-27T14:44:09Z https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501708#M8940 <P>Along the lines of your original idea to copy an event and modify it. You could do that and use <CODE>| collect</CODE> command to write it back to your index.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Collect">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Collect</A></P> Sat, 28 Mar 2020 00:11:44 GMT https://community.splunk.com/t5/Alerting/How-to-test-Splunk-alerts/m-p/501708#M8940 anthonymelita 2020-03-28T00:11:44Z