Alerting

how to edit alerts in Indexer

islam
Explorer

Hi,

we have one search head and one indexer, and installed db connect app on the indexer.

we created some searches on indexer related to db connect logs, and saved these searches as alerts.

the issue is we cannot edit or delete these searches or alerts, as the alerts tap is empty.

how can we edit there alerts.

Labels (1)
Tags (1)
0 Karma
1 Solution

tscroggins
Motivator

@islam 

If the searches aren't visible under Alerts, they likely have no alert actions defined. Check Reports or Settings > Searches, reports, and alerts to validate the schedule and alert actions.

In a simple two-tier environment like this, you should definitely move your alert searches and probably move DB Connect to your search head. Keep an eye on DB Connect JVM heap and HEC queue sizes.

View solution in original post

0 Karma

tscroggins
Motivator

@islam 

If the searches aren't visible under Alerts, they likely have no alert actions defined. Check Reports or Settings > Searches, reports, and alerts to validate the schedule and alert actions.

In a simple two-tier environment like this, you should definitely move your alert searches and probably move DB Connect to your search head. Keep an eye on DB Connect JVM heap and HEC queue sizes.

0 Karma

islam
Explorer

we already configured every alert to send mail as action, also as i mentioned, when we open settings >> Searches, reports, and alerts we didn't find our alerts under alerts tab or searched tab however the alerts work and we receive their mails properly.

0 Karma

tscroggins
Motivator

@islam 

Can you see the searches under Settings > All configurations with App set to All and Owner set to Any? If yes, ensure the searches are exported (shared) correctly and have the owner you expect.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...