Alerting

How to create an alert using savedsearches.conf splunk btool savedsearches list

human96
Communicator

I think savedsearches.conf contains information about alerts and reports. If you execute the following btool command and check the result, which is the report or the alert? I can't tell.

if i use splunk btool savedsearches list

<Question 1>

From the btool results, what parameters can I look at to determine that the stanza is a report?

<Question 2>

From the btool results, what parameters can I look at to determine that the stanza is an alert?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

When you create an alert and report from exactly same search you can do a diff for those like this.

diff -au report alert
--- report	2022-02-14 13:32:07.000000000 +0200
+++ alert	2022-02-14 13:32:17.000000000 +0200
@@ -1,6 +1,5 @@
-[SSL Cert exp report]
+[SSL Cert exp alert]
 action.email = 0
-action.email.useNSSubject = 1
 action.populate_lookup = 0
 action.rss = 0
 action.script = 0
@@ -10,11 +9,11 @@
 alert.expires = 24h
 alert.managedBy =
 alert.severity = 3
-alert.suppress =
+alert.suppress = 0
 alert.suppress.fields =
 alert.suppress.group_name =
 alert.suppress.period =
-alert.track = 0
+alert.track = 1
 alert_condition =
 allow_skew = 0
 auto_summarize = 0
@@ -32,7 +31,7 @@
 auto_summarize.suspend_period = 24h
 auto_summarize.timespan =
 auto_summarize.workload_pool =
-counttype = always
+counttype = number of events
 cron_schedule = 0 6 * * 1
 defer_scheduled_searchable_idxc = 0
 description =
@@ -392,7 +391,7 @@
 display.visualizations.mapping.tileLayer.tileOpacity = 1
 display.visualizations.mapping.tileLayer.url =
 display.visualizations.mapping.type = marker
-display.visualizations.show = 0
+display.visualizations.show = 1
 display.visualizations.singlevalue.afterLabel =
 display.visualizations.singlevalue.beforeLabel =
 display.visualizations.singlevalue.colorBy = value

 Based on that example it could be hard to separate those 100% sure from each other. It depend which kind of methods you are using for alerts (here I used "Add to triggered alerts").

So maybe fields: alert.suppress, alert.track can be those fields in general case? Of course if you have always some alert.actions in use you could look that from those outputs to check if it exists or not.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...