Alerting

Creating real time Alerts using Splunk REST API

rishabh98
New Member

Hi. I am trying to create real-time alerts using splunk REST API by using https://localhost:8089/services/saved/searches?output_mode=json POST API with the following parameters :-

  1. alert_type = always
  2. is_scheduled = 1
  3. cron_schedule = * * * * *
  4. alert_comparator = greater than
  5. alert_threshold = 0
  6. search = index=*
  7. name = Demo-alert-test
  8. actions = webhook
  9. action.webhook.param.url = my-webhook-url
  10. allow_skew = 0 

    With the help of these parameters, I am only generating alerts with cron scheduling. Is there any way to create alerts for real time scheduling. Need Good suggestions. Thanks!
Labels (2)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.