All Apps and Add-ons

Create an alert based on SQL query results from DB Input

vchitrala
New Member

Hi ,
I'm new to Splunk , I'm using DB connect V2 . Want to create an alert based on a query in DB Input , I have a field called 'Duration_Hrs' .
I want to trigger email chain if duration exceeds over 24 hours . What are detailed steps I need to follow?

0 Karma

jnussbaum_splun
Splunk Employee
Splunk Employee

You'll first want to construct a search that returns results that you'd like to be alerted on:

example (assuming you're indexing the data from your DB, and you'd like all fields present in your alert): index=my_db_index Duration_Hrs>24 | table *

Then: Save As -> Alert

There's a dozen or so fields you'll want to fill out within the "Save As Alert" box. I'd suggest reading the following : http://docs.splunk.com/Documentation/Splunk/latest/Alert/Definescheduledalerts . There are time windows and intervals you'll want to set to capture data in your required manner.

0 Karma

hemendralodhi
Contributor

Hello,

If we are directly running the query against DB and not indexing data, will it send alert? I am trying to set up alert for this but it is not sending any data content . Only email with "Search Complete" is coming.
I tried with sendresult=true inline=true sendcsv=true also.

Thanks
Hemendra

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...