Issue wtih Alert Manager Add-On for Splunk Cloud?

[rdiazalo]

Hi,

I got an issue configuring alert manager app. The incident posture filter is not working.

rdiazalo_0-1668764760203.png

It does not matter what info I change inside the red box. The alerts that are shown below does not change at all.

Any help will be grateful.

[rohe]

Hi @gcusello ,

What could be the problem for me?

I can't define a user

Bildschirmfoto 2023-01-22 um 09.18.33.png

 

Bildschirmfoto 2023-01-22 um 09.19.37.png

 

[gcusello]

Hi @rohe,

sorry I didn't see this error.

Please could you share a screenshot in english, you can do this replacing the language in the link with "en-US".

Ciao.

Giuseppe

[gcusello]

Hi @rdiazalo,

to see alerts in Alert Manager, you have to configure all your alerts as Global, otherwise you don't see in this App.

If you found some error in JS execution, there's a message that you can find on the GitHub site.

Ciao.

Giuseppe

[rdiazalo]

Hi @gcusello, 

Al the alerts are in global.

rdiazalo_0-1668765584664.png

I can see al the alerts on the dashboard. What I cannot do is to filter them. If I choose to just see the ones with new status, it still show me all the alerts.  In this example I select to just see critical alerts in the las 24 hours but it still shows me all alerts of the last 24 hours.

rdiazalo_1-1668765898809.png

[gcusello]

Hi @rdiazalo,

it's strange I haven't your behaviour:

gcusello_0-1668766915534.png

and the only customization I did was the Global sharing.

Which version are you using? I'm using 3.0.11.

Ciao.

Giuseppe

[rdiazalo]

This are the version of alert manager that I have:

rdiazalo_0-1668768008519.png

I made a health test and find that TA- alert_manager got a warning. 

rdiazalo_1-1668768242557.png

What version of Alert Manager Add-on do you have?

[gcusello]

Hi @rdiazalo,

I haven't the Add-On.

Ciao.

Giuseppe

[rdiazalo]

Hi @gcusello ,

I have perform a restart today to delete Alert manager Add-On but the filter still don't work. 

Did you change any query or something for it to work?

Regards 

[gcusello]

Hi @rdiazalo,

No I didn't, the only customization was the Global sharing for all alerts.

Ciao.

Giuseppe

[rdiazalo]

Hi @gcusello ,

I found what the issue was. 

I had an issue importing the query.

Can you send me your Search String? I think that my query still has some issues. So I would like to compare mine with yours.

rdiazalo_0-1670406783255.png

Regards,