Alerting

How to create an alert using savedsearches.conf splunk btool savedsearches list

human96
Communicator

I think savedsearches.conf contains information about alerts and reports. If you execute the following btool command and check the result, which is the report or the alert? I can't tell.

if i use splunk btool savedsearches list

<Question 1>

From the btool results, what parameters can I look at to determine that the stanza is a report?

<Question 2>

From the btool results, what parameters can I look at to determine that the stanza is an alert?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

When you create an alert and report from exactly same search you can do a diff for those like this.

diff -au report alert
--- report	2022-02-14 13:32:07.000000000 +0200
+++ alert	2022-02-14 13:32:17.000000000 +0200
@@ -1,6 +1,5 @@
-[SSL Cert exp report]
+[SSL Cert exp alert]
 action.email = 0
-action.email.useNSSubject = 1
 action.populate_lookup = 0
 action.rss = 0
 action.script = 0
@@ -10,11 +9,11 @@
 alert.expires = 24h
 alert.managedBy =
 alert.severity = 3
-alert.suppress =
+alert.suppress = 0
 alert.suppress.fields =
 alert.suppress.group_name =
 alert.suppress.period =
-alert.track = 0
+alert.track = 1
 alert_condition =
 allow_skew = 0
 auto_summarize = 0
@@ -32,7 +31,7 @@
 auto_summarize.suspend_period = 24h
 auto_summarize.timespan =
 auto_summarize.workload_pool =
-counttype = always
+counttype = number of events
 cron_schedule = 0 6 * * 1
 defer_scheduled_searchable_idxc = 0
 description =
@@ -392,7 +391,7 @@
 display.visualizations.mapping.tileLayer.tileOpacity = 1
 display.visualizations.mapping.tileLayer.url =
 display.visualizations.mapping.type = marker
-display.visualizations.show = 0
+display.visualizations.show = 1
 display.visualizations.singlevalue.afterLabel =
 display.visualizations.singlevalue.beforeLabel =
 display.visualizations.singlevalue.colorBy = value

 Based on that example it could be hard to separate those 100% sure from each other. It depend which kind of methods you are using for alerts (here I used "Add to triggered alerts").

So maybe fields: alert.suppress, alert.track can be those fields in general case? Of course if you have always some alert.actions in use you could look that from those outputs to check if it exists or not.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...