Alerting

What is the role of expiration when setting up an Alert?

auzark
Path Finder

Can someone, please explain to me what expires does when setting up an alert. I can not find an explanation in the manuals, I search.

auzark_0-1647409563938.png

 

Labels (2)
Tags (2)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

Hi @auzark 

Expries meaning , after an alert triggers with output , how long you can able to access that results, before it expries, 

in your example ,alert runs at 15 th minutes of every hour means if alert trigger at 11:15  AM  with output of  15 records, the results will be avalible until 03:15 PM , after that you no loner has access to results.

and alerts runs at 12:15 PM will be active till 04:15 PM so on...

you can able to access triggered resluts from 

SanjayReddy_0-1647412612556.png


select your required alert name and click on view recent 

SanjayReddy_2-1647412653523.png

 

that shows all the previous triggered alerts click on name to get the results of the alert that triggerd at sepcific time 

SanjayReddy_3-1647412724661.png

 

---
If this reply helps you, Karma would be appreciated.

 

 

View solution in original post

SanjayReddy
SplunkTrust
SplunkTrust

Hi @auzark 

Expries meaning , after an alert triggers with output , how long you can able to access that results, before it expries, 

in your example ,alert runs at 15 th minutes of every hour means if alert trigger at 11:15  AM  with output of  15 records, the results will be avalible until 03:15 PM , after that you no loner has access to results.

and alerts runs at 12:15 PM will be active till 04:15 PM so on...

you can able to access triggered resluts from 

SanjayReddy_0-1647412612556.png


select your required alert name and click on view recent 

SanjayReddy_2-1647412653523.png

 

that shows all the previous triggered alerts click on name to get the results of the alert that triggerd at sepcific time 

SanjayReddy_3-1647412724661.png

 

---
If this reply helps you, Karma would be appreciated.

 

 

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...