Does Splunk log it's Alert Actions?

bmayer00 · ‎10-01-2010

I am configuring SNMP traps based off of scheduled searches - does Splunk log this whenever a trap is generated? I ask because I don't want to duplicate logging that is already being done by Splunk.

ftk · ‎10-01-2010

Yes it does, in the _internal index.

The following search will pull up all alarm actions in a given time range:

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="")

Does Splunk log it's Alert Actions?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Catalog Is Now Generally Available on Splunk Cloud Platform

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Join the Conversation

Does Splunk log it's Alert Actions?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Catalog Is Now Generally Available on Splunk Cloud Platform

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner