topic Re: Dashboard Frequency of a Splunk Alert in Dashboards & Visualizations

Create a Visualization that shows Dashboard Frequency of a Splunk Alert?

rthomas247 — Sat, 31 Dec 2022 19:13:57 GMT

Hi,

I'd like to create a visualization that shows trends between alerts that have been fired. The graph will show the frequency of a given range of alerts and how often they was triggered on the source file.

Thanks,

Rob

Re: Dashboard Frequency of a Splunk Alert

richgalloway — Fri, 23 Jul 2021 12:43:56 GMT

It's not clear to me exactly what you want, but I believe you should start with a list of fired alerts. Get it with this query.

| rest/servicesNS/-/-/alerts/fired_alerts

Re: Dashboard Frequency of a Splunk Alert

rthomas247 — Fri, 23 Jul 2021 17:43:07 GMT

@richgalloway , Thanks for the quick turnaround.

I'd like to create a dashboard that shows me all my alerts that have fired over a given time period so I can gauge how often the alerts are fired compared to one another in a bar chart | pie chart. I'm looking to optimize alerts that are fired too often.

for example, if I have 100 alerts and 40 of them fire every 10m - 15m. I want to be able to focus these 40 alerts to determine if I can optimize the query, reduce duplications or sunset the alert if it is no longer needed. Ideally, I'd like to start with a line or bar chart once I can see the data perhaps choose another chart to better represent the data.

Re: Dashboard Frequency of a Splunk Alert

richgalloway — Fri, 23 Jul 2021 18:54:24 GMT

Perhaps this search will be more helpful.

index=_internal sourcetype=Scheduler thread_id="AlertNotifier*" alert_actions=* NOT (alert_actions="summary_index" OR alert_actions="") | timechart count by savedsearch_name

Re: Dashboard Frequency of a Splunk Alert

rthomas247 — Tue, 03 Aug 2021 16:08:58 GMT

Thanks! This is it!

Re: Dashboard Frequency of a Splunk Alert

onurasln55 — Sat, 31 Dec 2022 09:49:09 GMT

There is no _internal index. Could it be disabled by admin?

Re: Dashboard Frequency of a Splunk Alert

richgalloway — Sat, 31 Dec 2022 13:33:20 GMT

There is always an _internal index. It may be possible for an admin to rename it, but that would break so much stuff that it would be a crazy thing to attempt.

It's more likely you don't have access to _internal.