All Apps and Add-ons

Why would alerts show in "KPI Report - Incident Status" report as long runners, but not show up on incident posture page?

joshua_hart1
Path Finder

Occasionally, alerts will fire that seem to get stuck and never make it into the Incident Posture dashboard. When I check the Incident Status KPI dashboard, they show up in the Long Runners but searching for the incident id yields no results. Please advise. Thanks!

-Josh

Tags (1)
0 Karma

my2ndhead
SplunkTrust
SplunkTrust

I suspect, that some large events created as "index=alerts sourcetype=alert_metadata" may get truncated.

There's a bugfixes version of TA-alert_manager you could try out:

https://github.com/alertmanager/TA-alert_manager/tree/develop

Download as a zip file, and rename the directory to TA-alert_manager

0 Karma

joshua_hart1
Path Finder

Thanks, I'll give that a try and report back.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.