All Apps and Add-ons

Why would alerts show in "KPI Report - Incident Status" report as long runners, but not show up on incident posture page?

joshua_hart1
Path Finder

Occasionally, alerts will fire that seem to get stuck and never make it into the Incident Posture dashboard. When I check the Incident Status KPI dashboard, they show up in the Long Runners but searching for the incident id yields no results. Please advise. Thanks!

-Josh

Tags (1)
0 Karma

my2ndhead
SplunkTrust
SplunkTrust

I suspect, that some large events created as "index=alerts sourcetype=alert_metadata" may get truncated.

There's a bugfixes version of TA-alert_manager you could try out:

https://github.com/alertmanager/TA-alert_manager/tree/develop

Download as a zip file, and rename the directory to TA-alert_manager

0 Karma

joshua_hart1
Path Finder

Thanks, I'll give that a try and report back.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...