Alerting

How to pull a report on Splunk alerts?

bjaylsu
New Member

I'm application analyst that monitors splunk alerts. We monitor OOM, CPU usage and other data. We receive alerts via MS outlook.

Is there a way to pull reports on the splunk alerts for the last 6 months. I'd like to see how many alerts we receive daily, monthly, etc. Is that possible via splunk?

Here are the details of Splunk version which I am using: 6.6.1

0 Karma

MuS
Legend

Hi bjaylsu,

have a look at this answer https://answers.splunk.com/answers/305328/how-to-search-the-names-of-triggered-alerts-their.html#ans... it will provide you a search that creates a report of triggered alerts and their thresholds.

Be aware that you need to have the admin role assigned to be able to access index=_audit

Hope this helps ...

cheers, MuS

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...