Alerting

How to set alert to know any alert Script is ran/not for the scheduled alert

phanichintha
Path Finder

Hello!

Can anyone please help how to know if we ran an alert/not for a scheduled alert? 
We set the below alert for every Monday 6:00 am.

Alert Example:

| makeresults
| eval ip_ports = "10.120.121.100:9443"
| eval ip_ports = split(ip_ports,",")
| mvexpand ip_ports
| rex field=ip_ports "(?<dest>[^:]+):(?<dest_port>\d+)"
| table dest dest_port
| lookup sslcert_lookup dest dest_port
| eval days_left = round(ssl_validity_window/86400)
| eval ssl_end_time=strftime(ssl_end_time,"%Y-%m-%d")
| eval ssl_start_time=strftime(ssl_start_time,"%Y-%m-%d")
| where days_left < 60

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk logs that for you.  Search the logs with a query like this:

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="<alert name>"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway Hello, thanks for the query i got great results, so some more need to do based on the below query, I need an alert for if any of the searches are not run I need the alert to mail.

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="Expiry of SSL Certificates for UI Instances" OR savedsearch_name="Expiry of SSL Certificates for FR Instances" OR savedsearch_name="Expiry of SSL Certificates for Mulesoft Instances" OR savedsearch_name="Expiry of DNS SSL Certificates"
| stats count by savedsearch_name

phanichintha_0-1626786110610.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Search for status != success

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway I didn`t get any results other than success. I need other than success saved alerts out of 4.

phanichintha_0-1626789705518.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Congratulations!  None of your alerts failed to run.  Save that search as an alert and have it trigger when the number of results is not zero.  That will happen when status!=success some time in the future.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...