topic Re: Splunk query in Splunk Search

Splunk query

Gayathirik — Thu, 08 Sep 2016 07:21:50 GMT

I need to write a query for creating an alert whenever there is message in the "Splunk bar" message tab.

Please help me with this.

Re: Splunk query

renjith_nair — Thu, 08 Sep 2016 08:30:15 GMT

Write a search to find the message in Splunk bar
Save as alert
Select the schedule of the alert
Under trigger conditions select Number of Results and then is greater than 0 option
Select your trigger actions

Reference :

http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/AlertWorkflowOverview
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Definescheduledalerts

Re: Splunk query

Gayathirik — Fri, 09 Sep 2016 05:40:35 GMT

am clear about the process of creating an alert. Could you please help me in writing the splunk query whenever we get a pop up message in the splunk message tab?

Re: Splunk query

renjith_nair — Fri, 09 Sep 2016 06:55:21 GMT

Alright !

Try this

| rest /services/messages| table title message severity timeCreated_iso published splunk_server author

Re: Splunk query

WalshyB — Fri, 09 Sep 2016 09:45:19 GMT

This should help- https://answers.splunk.com/answers/206670/is-there-a-way-to-retrieve-the-messages-from-the-b.html

Re: Splunk query

Gayathirik — Mon, 12 Sep 2016 02:25:17 GMT

This doesnt meet my requirement.

My issue here is For example: in the message tab some warning or error message like "indexer is down or too many streamings to the target" is popped out then the same thing has to be triggered as an alert whenever there is a message pop up in splunk bar.

Re: Splunk query

esix_splunk — Mon, 12 Sep 2016 02:27:00 GMT

There is no list of these messages. But you should be able to find these in the "_internal" index. Create alerts for these as you would a normal event.