Alerting

Don't Expire Alerts

Engager

Hello All,

Sorry to ask a silly question, I had a look around, but unable to find a solution.

When we set an alert in Splunk, there is an Expires Parameter.

I understand this is TTL for the Alert (Sorry if I have misunderstood it).

I don't want my Alert to Expire.
How can I achieve this please?

If there is no means to achieve this, is there a way to trigger a notification, when that alert is about to expire please?
I tried couple of options in alert setting, to see if splunk triggers a notification when an alert expires, I am afraid no notification was triggered.

For example set "Trigger Condition", "Trigger Time" and set the alert to Expire in 10 mins. The alert Expired but no notification was triggered via email.
I had a feeling it won't work, as Trigger Condition means - The condition that triggers the alert and NOT alert expiry - but just tried my luck!

Best Regards,

Labels (1)
0 Karma
1 Solution

Super Champion

Hi @raghul725 ,
Expires Parameter in alert define the lifespan of triggered Alert basically how long you can access the result of triggered alert.
Even though you set the alert Expire in 0 min doesn't mean it won't get trigger at your scheduled time after 10 min . It will get triggerred .
Just the trigger alert results you can see trigger alert results till 10 min after alert gets trigger.
Hope this explains!

View solution in original post

0 Karma

Super Champion

Hi @raghul725 ,
Expires Parameter in alert define the lifespan of triggered Alert basically how long you can access the result of triggered alert.
Even though you set the alert Expire in 0 min doesn't mean it won't get trigger at your scheduled time after 10 min . It will get triggerred .
Just the trigger alert results you can see trigger alert results till 10 min after alert gets trigger.
Hope this explains!

View solution in original post

0 Karma

Engager

So essentially, what we are saying here is

Alert Expire field defines how long the alert will be visible, once triggered and does NOT set an expiry on the alert trigger i.e. alter trigger will be enabled until that is disabled manually.

0 Karma

Engager

brilliant thanks

0 Karma

Super Champion

Yes you understand correctly. 🙂

0 Karma