Saved Searches - Log Events to Existing Index - Not working

[iamsgsn]

Hello,

I've created real-time alerts in Splunk Enterprise 7.1.2, and I want to log each triggered event to an index, so I can create a dashboard that shows alerts over time. The task seems pretty straight forward ( create alert, add action, log event, etc); however, I cannot get this to work. I'm trying to redirect this to my existing index.

This seems to be not working, and I don't have access to the main index as per my company's policy. Please help me in logging this event to my custom index.

Looking forward to hear from you.

[mayurr98]

Are you looking to index events which are triggered through alert?
Then :
2) Create a new index
1) Edit the alert you want to index.Go to Trigger Actions and click on + Add Actions
2) click on "Log Event" and specify the index details.

Then you should see triggered events in that index

let me know if this helps!

[iamsgsn]

Hello Thanks for the reply.
So you mean to say it won't work with any of the existing indexes? i tried with my existing index and i am not able to query the events after doing the above mentioned steps.
Let me know how can i achieve the same using existing indexes and source types.

[richgalloway]

Are you looking for a list of alerts that have triggered recently or something more than that?

For triggered alerts, try | rest/servicesNS/-/-/alerts/fired_alerts| search NOT title="-". This is maintained automatically by Splunk so you don't have to use your own indexing.