All Apps and Add-ons

Alert Manager -- Does anyone have this app working?

jamesklassen
Path Finder

So this app looks amazing and exactly what my team needs, but I can NOT get this thing working. Has anyone out there in the community managed to run this thing successfully? It's just been one problem after another and I don't think I'm getting anywhere. 

Right now I think I've narrowed the issue to a line in the "alert_manager_scheduler.log" in splunk/var/log, which states: ...message="No saved searches found in system, skipping..."(alert_manager_scheduler.py:86)

Additionally, there is no data in my alerts index...which is what I had set as the index in Global Settings. 

Note that I'm on Windows, and in an offline (no internet) environment. 

The app in question is here: Alert Manager | Splunkbase

Documentation here: Introduction - Alert Manager

Labels (1)
0 Karma
1 Solution

jamesklassen
Path Finder

I completely missed a step. I've got it working now.

For anyone else who is in a similar situation in the future, you need to add the 'Alert Manager' Triger Action to your existing alerts before they'll feed into Alert Manager.  I had unfortunately just assumed that all my existing alerts would magically appear in the 'Alert Manager' dashboard. 

View solution in original post

0 Karma

jamesklassen
Path Finder

I completely missed a step. I've got it working now.

For anyone else who is in a similar situation in the future, you need to add the 'Alert Manager' Triger Action to your existing alerts before they'll feed into Alert Manager.  I had unfortunately just assumed that all my existing alerts would magically appear in the 'Alert Manager' dashboard. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...