Alerting

how to edit alerts in Indexer

islam
Explorer

Hi,

we have one search head and one indexer, and installed db connect app on the indexer.

we created some searches on indexer related to db connect logs, and saved these searches as alerts.

the issue is we cannot edit or delete these searches or alerts, as the alerts tap is empty.

how can we edit there alerts.

Labels (1)
Tags (1)
0 Karma
1 Solution

tscroggins
Motivator

@islam 

If the searches aren't visible under Alerts, they likely have no alert actions defined. Check Reports or Settings > Searches, reports, and alerts to validate the schedule and alert actions.

In a simple two-tier environment like this, you should definitely move your alert searches and probably move DB Connect to your search head. Keep an eye on DB Connect JVM heap and HEC queue sizes.

View solution in original post

0 Karma

tscroggins
Motivator

@islam 

If the searches aren't visible under Alerts, they likely have no alert actions defined. Check Reports or Settings > Searches, reports, and alerts to validate the schedule and alert actions.

In a simple two-tier environment like this, you should definitely move your alert searches and probably move DB Connect to your search head. Keep an eye on DB Connect JVM heap and HEC queue sizes.

0 Karma

islam
Explorer

we already configured every alert to send mail as action, also as i mentioned, when we open settings >> Searches, reports, and alerts we didn't find our alerts under alerts tab or searched tab however the alerts work and we receive their mails properly.

0 Karma

tscroggins
Motivator

@islam 

Can you see the searches under Settings > All configurations with App set to All and Owner set to Any? If yes, ensure the searches are exported (shared) correctly and have the owner you expect.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...