health check for rules

karakutu · ‎12-01-2020

I have a lot of different alerts on our splunk. after every upgrade or change on splunk we just want to check if our alerts work well or not.

how can we ensure the quality of the alerts? how can we report if our alerts work properly as planed?

thanks

richgalloway · ‎12-01-2020

You will need to inject data into Splunk that will trigger your alerts. The data should also make it clear it is for test purposes so as to avoid causing alarm.

---
If this reply helps you, Karma would be appreciated.

health check for rules

alert condition

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

health check for rules

alert condition

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...