Alerting

What is the Expires parameter of an alert?

danielbb
Motivator

I'm not clear about the Expires parameter of an alert. What does it mean?

alt text

Tags (2)
0 Karma

saravanan90
Contributor

The impact would be that the dispatch directory(/opt/splunk/var/run/splunk/dispatch) which stores this results set will get filled. Search head bundle will not have this result set. 

https://docs.splunk.com/Documentation/Splunk/8.1.1/DistSearch/HowconfrepoworksinSHC#How_replication_...

0 Karma

ajitshukla61116
Path Finder

It define the lifespan of triggered Alert basically how long you can access the result of triggered alert.

Please refer this documenthttps://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/Updatealerts for better understanding.

danielbb
Motivator

Let's say we have an alert scheduled to run every five minutes, producing large result-sets and Expires of the alert is set to 24 hours. What's the impact on the system? Do the result-sets live in the search head bundle?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...