Dashboards & Visualizations

add recently triggered alerts to my dashboard


I'm creating a dashboard and have an idea to place recently triggered alerts on corresponding plot.
It will help to tune alerts and show that they are working good..
Is it possible to do something like this ? And how can I do that?
thanks a lot...

0 Karma


Hi 0range

I use a summary saved search like this:

index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity

In the advanced XML dashboard I use a single value graph with rangemap like this:

 <module name="HiddenSearch" layoutPanel="panel_row1_col2" autoRun="True">
            <param name="search"> index=summary search_name="YourSavedSearch" | table trigger_time ss_name severity | stats count | rangemap field=count low=0-0 elevated=1-1 default=severe</param>
            <module name="SingleValue" > 
                <param name="beforeLabel">Overall Status: </param> 
                <param name="afterLabel"> Alerts have been fired</param> 
                <param name="linkFields">result</param>
                <param name="linkView">flashtimeline</param>
                <param name="linkSearch">
                    index=summary search_name="YourSavedSearch" | table trigger_time ss_name severity

hope this helps ...

cheers, MuS

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!