topic Re: Automatic alert creation in Alerting

Automatic alert creation

ngutha — Fri, 25 Sep 2020 16:01:15 GMT

Is there a way we can automatically create alerts on Splunk. I am able to manually create alerts, but wondering how to create alerts using automation.

Re: Automatic alert creation

richgalloway — Fri, 25 Sep 2020 16:46:05 GMT

What is the use case for creating alerts automatically?

You can create an alert programmatically using the REST API. An alert is just a scheduled search with an action. See https://docs.splunk.com/Documentation/Splunk/8.0.6/RESTREF/RESTsearch#saved.2Fsearches

Re: Automatic alert creation

ngutha — Fri, 25 Sep 2020 17:17:14 GMT

@richgalloway For example: If I have say 200 alerts that were manually created on a North American data center. Say I want to spin up an Australian Data center but do not want to create the same 200 alerts again. Is there a way I can automate alert creation?

Re: Automatic alert creation

richgalloway — Fri, 25 Sep 2020 18:08:52 GMT

The easiest method is to put your custom alerts in their own app. Then you can copy the entire app to the new DC.