Make this event an alert?

Michael_Wilde · ‎09-11-2010

I'd like to provide an option, either on workflow actions menu, or just a link/form in the UI that took information from an event (Fields i choose), and allow for the creation of a future alert. The technical part would be:

Take info from event
Create saved/scheduled search that sends email/snmp trap.
Respond with success or fail (nice to have).

thoughts?

woodcock · ‎05-26-2015

This capability is in the latest versions of Splunk. In v6, after running any search, there is a save as menu just above the time picker and Alert is an option. If you select this, it takes you through a wizard that lets you set options such as sending emails.

Make this event an alert?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

Make this event an alert?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs