Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Don't Expire Alerts
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
Sorry to ask a silly question, I had a look around, but unable to find a solution.
When we set an alert in Splunk, there is an Expires Parameter.
I understand this is TTL for the Alert (Sorry if I have misunderstood it).
I don't want my Alert to Expire.
How can I achieve this please?
If there is no means to achieve this, is there a way to trigger a notification, when that alert is about to expire please?
I tried couple of options in alert setting, to see if splunk triggers a notification when an alert expires, I am afraid no notification was triggered.
For example set "Trigger Condition", "Trigger Time" and set the alert to Expire in 10 mins. The alert Expired but no notification was triggered via email.
I had a feeling it won't work, as Trigger Condition means - The condition that triggers the alert and NOT alert expiry - but just tried my luck!
Best Regards,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @raghul725 ,
Expires Parameter in alert define the lifespan of triggered Alert basically how long you can access the result of triggered alert.
Even though you set the alert Expire in 0 min doesn't mean it won't get trigger at your scheduled time after 10 min . It will get triggerred .
Just the trigger alert results you can see trigger alert results till 10 min after alert gets trigger.
Hope this explains!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @raghul725 ,
Expires Parameter in alert define the lifespan of triggered Alert basically how long you can access the result of triggered alert.
Even though you set the alert Expire in 0 min doesn't mean it won't get trigger at your scheduled time after 10 min . It will get triggerred .
Just the trigger alert results you can see trigger alert results till 10 min after alert gets trigger.
Hope this explains!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So essentially, what we are saying here is
Alert Expire field defines how long the alert will be visible, once triggered and does NOT set an expiry on the alert trigger i.e. alter trigger will be enabled until that is disabled manually.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
brilliant thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you understand correctly. 🙂
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
