Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- how to edit alerts in Indexer
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
we have one search head and one indexer, and installed db connect app on the indexer.
we created some searches on indexer related to db connect logs, and saved these searches as alerts.
the issue is we cannot edit or delete these searches or alerts, as the alerts tap is empty.
how can we edit there alerts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the searches aren't visible under Alerts, they likely have no alert actions defined. Check Reports or Settings > Searches, reports, and alerts to validate the schedule and alert actions.
In a simple two-tier environment like this, you should definitely move your alert searches and probably move DB Connect to your search head. Keep an eye on DB Connect JVM heap and HEC queue sizes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the searches aren't visible under Alerts, they likely have no alert actions defined. Check Reports or Settings > Searches, reports, and alerts to validate the schedule and alert actions.
In a simple two-tier environment like this, you should definitely move your alert searches and probably move DB Connect to your search head. Keep an eye on DB Connect JVM heap and HEC queue sizes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we already configured every alert to send mail as action, also as i mentioned, when we open settings >> Searches, reports, and alerts we didn't find our alerts under alerts tab or searched tab however the alerts work and we receive their mails properly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you see the searches under Settings > All configurations with App set to All and Owner set to Any? If yes, ensure the searches are exported (shared) correctly and have the owner you expect.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
