Alerting

Is there a action available in Spluk alert to store in index ?

nandha_2
Engager

Hi,
I would like to move saved search aka Alert to an index instead of triggering an email ? is it possible in splunk to do that ?

Thanks
nandha

Tags (1)
0 Karma

lguinn2
Legend

You cannot place an alert directly into an index. However, you could trigger a script as an alert action. The script could write data to a log file (maybe you could call it "alert.log"). Have Splunk monitor the log file (alert.log) and index it.
Voila! You now have information about your alerts in an index.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...