Is there a way to trigger an alert through a dashboard button?

[paimonsoror]

I had an interesting request today from a team who was looking to enhance their Splunk dashboard by allowing for a manual trigger of an Alert.

We currently have a custom alert set up that essentially does an snmp trap over to some of our alert monitoring tools. Most teams are using this alert in the typical fashion (i.e. scheduled searches that trigger alert on specific value).

However this one team needs more of an ad-hoc alerting. They have their engineers analyze some of the data that they are reporting on, and until they come up with the appropriate algorithms and such to automate via schedules and the like, they would like to have a button that would actually kick off the alert action.

Is this possible?

[kamlesh_vaghela]

HI,

You can make by using sendalert search command.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Sendalert

Create your custom alert and execute by running search in dashboard.

I hope this will help you.

Thanks

[nkpiquette]

I would recommend combining this with sideview utilities to embed a button into a table. The button's search should contain the sendalert command. See https://answers.splunk.com/answers/390073/table-module-per-rowchecbox.html to get more information about embedding a button into the table.

[kamlesh_vaghela]

Agreed.....

[DalJeanis]

That depends entirely on what you mean by "kick off an alert action", and how many different actions you envision doing.

You absolutely CAN do it.

A panel can run a search, based on tokens that can include arbitrary text.

A search can collect records into a (summary) index or output records to a csv file.

A scheduled or real-time search can pick up records from an index or csv file and perform functions based on them, once per record.

Given each of the above facts, you can obviously set up a panel that will add a record to an index or file that will effectively set off an alert.

To what degree you will need to create infrastructure to make it work, that depends on the first question I asked.

[paimonsoror]

Wow, this is a very cool concept. To answer your question, just a single action so hopefully that makes it easier. I am going to have to mull this one over a bit!

But it sounds like there is goign to be some 'tricks' to get this working vs just a simple 'do my alert now' button.