Alerting

What is the query string to create an alert to trigger when another user creates an alert?

jordanm
Observer

Hello -

We are trying to determine how to create an alert to tell us when other users create alerts. I'm aware this is somewhat recursive thinking.

index=_internal sourcetype=scheduler user=maidman | eval is_realtime=if(searchmatch("sid=rt* OR concurrency_category=real-time_scheduled"),"yes","no")
|table savedsearch_name, user, date_hour, date_minute

Tells me when an alert ran but not the creation date.

Labels (1)
0 Karma

renjujacob88
Path Finder

The logic below populates all the alerts to the test_alert_track lookup and display the alerts which are created within one day.

|rest splunk_server=local /servicesNS/-/search/saved/searches | search alert.track=1
| eval updated = strptime(updated,"%Y-%m-%dT%H:%M:%S")
| stats max(updated) as lastTime min(updated) as firsTime values(author) as author values(alert.track) as alert.track by title
| inputlookup append=t test_alert_track.csv
| stats min(firsTime) as firsTime max(lastTime) as lastTime values(author) as author values(alert.track) as alert.track by title
| outputlookup test_alert_track.csv
| search author!=nobody
| where now()-firsTime < 86400

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...