Alerting

Creating real time Alerts using Splunk REST API

rishabh98
New Member

Hi. I am trying to create real-time alerts using splunk REST API by using https://localhost:8089/services/saved/searches?output_mode=json POST API with the following parameters :-

  1. alert_type = always
  2. is_scheduled = 1
  3. cron_schedule = * * * * *
  4. alert_comparator = greater than
  5. alert_threshold = 0
  6. search = index=*
  7. name = Demo-alert-test
  8. actions = webhook
  9. action.webhook.param.url = my-webhook-url
  10. allow_skew = 0 

    With the help of these parameters, I am only generating alerts with cron scheduling. Is there any way to create alerts for real time scheduling. Need Good suggestions. Thanks!
Labels (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!