Splunk alert result(s) to a dashboard input and then email results


How can I send alert result(s) to a dashboard input and then email dashboard results? Please let me know if anybody has worked on this before. thank you!

0 Karma


As mentioned you can also schedule from a Dashboard itself if this fits your use case.
After a Dashboard has been created Edit > Schedule > Email To

0 Karma


If you are using the monitoring console or have it as a search peer, try the below:
index=_audit action="alert_fired" AND host=YOUR_DMC
| eval severity=case(severity==1,"debug", severity==2, "info", severity==3,"warning", severity==4,"error",severity=5,"severe",severity==6,"fatal")
| rename ss_app as monitoring_app
| table ss_name, severity, timestamp, monitoring_app

You can then create a dashbaord from this as well as an email action that has the table above inline.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.