Does Splunk log it's Alert Actions?

bmayer00 · ‎10-01-2010

I am configuring SNMP traps based off of scheduled searches - does Splunk log this whenever a trap is generated? I ask because I don't want to duplicate logging that is already being done by Splunk.

ftk · ‎10-01-2010

Yes it does, in the _internal index.

The following search will pull up all alarm actions in a given time range:

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="")

Does Splunk log it's Alert Actions?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Ditch the Manual Grind: Building AI Agents with Splunk

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Join the Conversation

Does Splunk log it's Alert Actions?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Ditch the Manual Grind: Building AI Agents with Splunk

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...