Alerting

Alerts Dashboard

maayan
Path Finder

Hi,

i need to find a way to present all alerts in a dashboard(Classic/Studio). users don't want to get mail for each alert, they prefer to see (maybe in a table ) all the alerts in one page + the alert's last result.
and maybe to click on the alert and get the last search.

is it possible to create an alerts dashboard?

thanks,
Maayan

Labels (1)
0 Karma

maayan
Path Finder

Hi,

Thanks! i will check. i dont have permission to install apps.
i wonder if there is an internal query to get all alerts and their results

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @maayan,

with this search you can list all the alerts

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| where alert_type!="always"
| table title

and with this search yu can list the fired alerts

index=_audit action="alert_fired" 
| rename ss_name AS title 
| join title [ | rest /services/saved/searches | table title, alert_threshold ] 
| timechart values(alert_threshold) AS alert_threshold count by title

Ciao.

Giuseppe

maayan
Path Finder

Hi,

It's a very useful query!

| rest splunk_server=local /servicesNS/-/-/saved/searches | where alert_type!="always" | table title,author,description,"eai:acl.owner","next_scheduled_time","action.email.to"



I need the alerts results and the second query doesn't work for me. i have already created an alert and see in under the "Alerts" tab and scheduled in today.
What i need to change in the second query to results? 
maybe something in the alert setting? or different index?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @maayan,

did you explored the Alert Manager App (https://splunkbase.splunk.com/app/2665)?

Try it, I usually use it when I cannot use ES.

Put attention only to one point: the app can see only alerts with a Global sharing.

Ciao.

Giuseppe

0 Karma

maayan
Path Finder

we don't have permission to install the app. i will try to ask the infra team again.
is there an option to add the alert result to this query?

| rest splunk_server=local /servicesNS/-/-/saved/searches | where alert_type!="always" | table title,author,description,"eai:acl.owner","next_scheduled_time","action.email.to"

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...