Alerting

How to set alert to know any alert Script is ran/not for the scheduled alert

phanichintha
Path Finder

Hello!

Can anyone please help how to know if we ran an alert/not for a scheduled alert? 
We set the below alert for every Monday 6:00 am.

Alert Example:

| makeresults
| eval ip_ports = "10.120.121.100:9443"
| eval ip_ports = split(ip_ports,",")
| mvexpand ip_ports
| rex field=ip_ports "(?<dest>[^:]+):(?<dest_port>\d+)"
| table dest dest_port
| lookup sslcert_lookup dest dest_port
| eval days_left = round(ssl_validity_window/86400)
| eval ssl_end_time=strftime(ssl_end_time,"%Y-%m-%d")
| eval ssl_start_time=strftime(ssl_start_time,"%Y-%m-%d")
| where days_left < 60

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk logs that for you.  Search the logs with a query like this:

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="<alert name>"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway Hello, thanks for the query i got great results, so some more need to do based on the below query, I need an alert for if any of the searches are not run I need the alert to mail.

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="Expiry of SSL Certificates for UI Instances" OR savedsearch_name="Expiry of SSL Certificates for FR Instances" OR savedsearch_name="Expiry of SSL Certificates for Mulesoft Instances" OR savedsearch_name="Expiry of DNS SSL Certificates"
| stats count by savedsearch_name

phanichintha_0-1626786110610.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Search for status != success

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway I didn`t get any results other than success. I need other than success saved alerts out of 4.

phanichintha_0-1626789705518.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Congratulations!  None of your alerts failed to run.  Save that search as an alert and have it trigger when the number of results is not zero.  That will happen when status!=success some time in the future.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...