Alerting

How to set alert to know any alert Script is ran/not for the scheduled alert

phanichintha
Path Finder

Hello!

Can anyone please help how to know if we ran an alert/not for a scheduled alert? 
We set the below alert for every Monday 6:00 am.

Alert Example:

| makeresults
| eval ip_ports = "10.120.121.100:9443"
| eval ip_ports = split(ip_ports,",")
| mvexpand ip_ports
| rex field=ip_ports "(?<dest>[^:]+):(?<dest_port>\d+)"
| table dest dest_port
| lookup sslcert_lookup dest dest_port
| eval days_left = round(ssl_validity_window/86400)
| eval ssl_end_time=strftime(ssl_end_time,"%Y-%m-%d")
| eval ssl_start_time=strftime(ssl_start_time,"%Y-%m-%d")
| where days_left < 60

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk logs that for you.  Search the logs with a query like this:

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="<alert name>"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway Hello, thanks for the query i got great results, so some more need to do based on the below query, I need an alert for if any of the searches are not run I need the alert to mail.

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="Expiry of SSL Certificates for UI Instances" OR savedsearch_name="Expiry of SSL Certificates for FR Instances" OR savedsearch_name="Expiry of SSL Certificates for Mulesoft Instances" OR savedsearch_name="Expiry of DNS SSL Certificates"
| stats count by savedsearch_name

phanichintha_0-1626786110610.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Search for status != success

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway I didn`t get any results other than success. I need other than success saved alerts out of 4.

phanichintha_0-1626789705518.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Congratulations!  None of your alerts failed to run.  Save that search as an alert and have it trigger when the number of results is not zero.  That will happen when status!=success some time in the future.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...