Alerting

Is there a way to convert a scheduled report to an alert? (6.6.3)

twinspop
Influencer

If a saved search is initially created as an alert, I get the option to "Edit alert". But if it's saved as a report, that option is not there and Edit Schedule does not offer the same options. I can't see any way to modify a report to have a conditional alert. I can schedule a report. And I can assign an email action to a report. But the GUI offers no way to assign a conditional action to a report. In order to get the conditional verbiage, I have to recreate the saved search explicitly as an alert. Or edit config files directly.

The new paradigm of reports vs alerts is not ... handy. Maybe I'm just not used to it.

v6.6.3, Linux

1 Solution

matt_park
Explorer

I think I found the answer. In your Searches, reports, and alerts, go to Edit > Advanced Edit >

change "alert_type" from "always" to "number of events".

set "alert_comparator" to "greater than"
set "alert_threshold" to "0"

Save and schedule your search (if you haven't already). At this point, you should be able to click Edit and see "Edit Alert" and the saved search will show up under the Alerts filter at the top instead of Reports

View solution in original post

matt_park
Explorer

I think I found the answer. In your Searches, reports, and alerts, go to Edit > Advanced Edit >

change "alert_type" from "always" to "number of events".

set "alert_comparator" to "greater than"
set "alert_threshold" to "0"

Save and schedule your search (if you haven't already). At this point, you should be able to click Edit and see "Edit Alert" and the saved search will show up under the Alerts filter at the top instead of Reports

View solution in original post

twinspop
Influencer

Nice. I mean, this still seems to be a bug to me, but nice workaround. :thumbs-up:

0 Karma

bhavya49
New Member

This solution doesn't seem to be working now. After Edit, I don't see any Advanced Edit.

0 Karma

pj
Contributor

Agree - super annoying

To add to the above solution. The search must also be scheduled for the above to work.

0 Karma

kmaron
Motivator

I ran into the same thing and as far as I can tell the only option is to recreate it as an alert which you already know about.

I did find this in my searching though I'm not sure if it helps any: https://answers.splunk.com/answers/187134/report-vs-alert-whats-the-difference.html

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi twinspop,
reports and alerts are different expressions of a search (eventually the same).
If the problem is to have a condition in the execution of a scheduled report, you can put this condition in your search: e.g. I have a report that lists all the non updated devices, but sometimes there is an error in the ingestion of the device situation, so in this case in my list there are thousands of not updated devices.
So I inserted in my search the condition | where count<1000 (usually there are few not updated devices) so I'm sure that it doesn't send a wrong report when there is a not updated situation, but only a correct one when situation is updated.
I hope I was clear.
Bye.
Giuseppe

0 Karma

twinspop
Influencer

I downvoted this post because not answering the question. extra search commands are not leading to the subject at hand: how to change a report to an alert in 6.6

0 Karma

gcusello
SplunkTrust
SplunkTrust

You cannotconvert a report in an alert, this is a running workaround that I used.
Bye.
Giuseppe

0 Karma

twinspop
Influencer

This is no longer accurate with Splunk 6.6.x.

0 Karma

gcusello
SplunkTrust
SplunkTrust

You have to find a different condition to verify your report execution.
Bye.
Giuseppe

0 Karma

twinspop
Influencer

No, the interface is totally different. If you have 6.6.x you will see.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Sorry but I explained badly:
you have to insert a condition in your search, something like | where count<1000 but relevant for your search.
Bye.
Giuseppe

0 Karma

twinspop
Influencer

If you're not running 6.6.x you don't understand. For REPORTS there is only an option to send an email when the report runs. Period. There is no qualifier for number of results returned, custom eval, or anything else. Even with "where count>0" i will still get email on every run regardless of results. In 6.6 REPORTS are inherently different from ALERTS and I don't see anyway to convert one way or the other.

0 Karma

gcusello
SplunkTrust
SplunkTrust

You have to insert the additional condition in the search used in report, in other words:
if original search is

index=my_index | stats dc(host) AS count

you have to modify search (not report conditions)

index=my_index | stats dc(host) AS count | where count<1000

Bye.
Giuseppe

0 Karma

twinspop
Influencer

Doesn't work in 6.6

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.