Alerting

Alert schedule cleanup

alekwisnia
Explorer

I got a bunch of alerts and reports scheduled - unfortunately most of them are scheduled for the same time. Is it possible to automatically review and correct those times? Does Splunk enterprise security have any "collision avoidance" mechanism in order to prevent that from happening while creating new corellation searches?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk has Schedule Windows and Skew which allow for colliding searches to run slightly after their scheduled times, but there is no mechanism to automatically reschedule searches.  It's up to you to do that.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!