All Apps and Add-ons

Create an alert based on SQL query results from DB Input

vchitrala
New Member

Hi ,
I'm new to Splunk , I'm using DB connect V2 . Want to create an alert based on a query in DB Input , I have a field called 'Duration_Hrs' .
I want to trigger email chain if duration exceeds over 24 hours . What are detailed steps I need to follow?

0 Karma

jnussbaum_splun
Splunk Employee
Splunk Employee

You'll first want to construct a search that returns results that you'd like to be alerted on:

example (assuming you're indexing the data from your DB, and you'd like all fields present in your alert): index=my_db_index Duration_Hrs>24 | table *

Then: Save As -> Alert

There's a dozen or so fields you'll want to fill out within the "Save As Alert" box. I'd suggest reading the following : http://docs.splunk.com/Documentation/Splunk/latest/Alert/Definescheduledalerts . There are time windows and intervals you'll want to set to capture data in your required manner.

0 Karma

hemendralodhi
Contributor

Hello,

If we are directly running the query against DB and not indexing data, will it send alert? I am trying to set up alert for this but it is not sending any data content . Only email with "Search Complete" is coming.
I tried with sendresult=true inline=true sendcsv=true also.

Thanks
Hemendra

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...