Alerting

RSS alert format

stuartamurray
Path Finder

Can I override or enhance the RSS format used for alerts?

Basically I have a scheduled search which aggregates errors over a -2m to -1m timescale. If it finds errors I want to raise an alert. However, I want to pass a search redirector that shows the originating errors, not the summarised errors. The idea is that the user gets the summary event (5 errors on Host XYZ) anc clicks a link that searches for relevant records in the timeframe of the aggregate.

I figured out the timeframe issues but need to be able to form a redirect then include that in the RSS.

Any clues?

Tags (1)
0 Karma

amit_saxena
Communicator

Hi,

I am not sure whether Splunk has any out of box way to do this but if I consider your requirement, there is an indirect way possible.

from RSS feed, extract the alert ID and from there extract the job name. Use REST API which takes job name as input to get job details and from the output of REST API, extract the original search. Once the search details is extracted, remove the summarized part and again execute it through REST API only. Finally configure alert over the search just executed the way you want.

Not the cleanest of the ways, moreover I haven't tried it but it seems possible.

Let me know how it works for you.

Regards,
Amit Saxena

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...