Alerting

Splunk alert result(s) to a dashboard input and then email results

pateriaak
Explorer

How can I send alert result(s) to a dashboard input and then email dashboard results? Please let me know if anybody has worked on this before. thank you!

0 Karma

dannyze
Explorer

As mentioned you can also schedule from a Dashboard itself if this fits your use case.
After a Dashboard has been created Edit > Schedule > Email To

0 Karma

jethrop
Explorer

If you are using the monitoring console or have it as a search peer, try the below:
index=_audit action="alert_fired" AND host=YOUR_DMC
| eval severity=case(severity==1,"debug", severity==2, "info", severity==3,"warning", severity==4,"error",severity=5,"severe",severity==6,"fatal")
| rename ss_app as monitoring_app
| table ss_name, severity, timestamp, monitoring_app

You can then create a dashbaord from this as well as an email action that has the table above inline.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...