RSS alert format

[stuartamurray]

Can I override or enhance the RSS format used for alerts?

Basically I have a scheduled search which aggregates errors over a -2m to -1m timescale. If it finds errors I want to raise an alert. However, I want to pass a search redirector that shows the originating errors, not the summarised errors. The idea is that the user gets the summary event (5 errors on Host XYZ) anc clicks a link that searches for relevant records in the timeframe of the aggregate.

I figured out the timeframe issues but need to be able to form a redirect then include that in the RSS.

Any clues?

[amit_saxena]

Hi,

I am not sure whether Splunk has any out of box way to do this but if I consider your requirement, there is an indirect way possible.

from RSS feed, extract the alert ID and from there extract the job name. Use REST API which takes job name as input to get job details and from the output of REST API, extract the original search. Once the search details is extracted, remove the summarized part and again execute it through REST API only. Finally configure alert over the search just executed the way you want.

Not the cleanest of the ways, moreover I haven't tried it but it seems possible.

Let me know how it works for you.

Regards,
Amit Saxena