Don't Expire Alerts

[raghul725]

Hello All,

Sorry to ask a silly question, I had a look around, but unable to find a solution.

When we set an alert in Splunk, there is an Expires Parameter.

I understand this is TTL for the Alert (Sorry if I have misunderstood it).

I don't want my Alert to Expire.
How can I achieve this please?

If there is no means to achieve this, is there a way to trigger a notification, when that alert is about to expire please?
I tried couple of options in alert setting, to see if splunk triggers a notification when an alert expires, I am afraid no notification was triggered.

For example set "Trigger Condition", "Trigger Time" and set the alert to Expire in 10 mins. The alert Expired but no notification was triggered via email.
I had a feeling it won't work, as Trigger Condition means - The condition that triggers the alert and NOT alert expiry - but just tried my luck!

Best Regards,

[493669 · Accepted solution]

Hi @raghul725 ,
Expires Parameter in alert define the lifespan of triggered Alert basically how long you can access the result of triggered alert.
Even though you set the alert Expire in 0 min doesn't mean it won't get trigger at your scheduled time after 10 min . It will get triggerred .
Just the trigger alert results you can see trigger alert results till 10 min after alert gets trigger.
Hope this explains!

[raghul725]

So essentially, what we are saying here is

Alert Expire field defines how long the alert will be visible, once triggered and does NOT set an expiry on the alert trigger i.e. alter trigger will be enabled until that is disabled manually.

[raghul725]

brilliant thanks

[493669]

Yes you understand correctly. 🙂