Alerting

Splunk alert result(s) to a dashboard input and then email results

pateriaak
Explorer

How can I send alert result(s) to a dashboard input and then email dashboard results? Please let me know if anybody has worked on this before. thank you!

0 Karma

dannyze
Explorer

As mentioned you can also schedule from a Dashboard itself if this fits your use case.
After a Dashboard has been created Edit > Schedule > Email To

0 Karma

jethrop
Explorer

If you are using the monitoring console or have it as a search peer, try the below:
index=_audit action="alert_fired" AND host=YOUR_DMC
| eval severity=case(severity==1,"debug", severity==2, "info", severity==3,"warning", severity==4,"error",severity=5,"severe",severity==6,"fatal")
| rename ss_app as monitoring_app
| table ss_name, severity, timestamp, monitoring_app

You can then create a dashbaord from this as well as an email action that has the table above inline.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...