How to create Alert in Cloud version of Splunk

[Evgeny197]

There is no option "Alert" when I try to "Save As" for current search. There is also no "Access Controls" in "Settings".

My final plan is to send alerts to Slack channels, but all the instructions I was able to find are for different versions of Splunk (Enterprise etc). Could someone point me in a right direction?

Thank you!

[Evgeny197]

It is a new search

[Evgeny197]

This is what I see

[marnall]

Are you able to check if your user has a role with the schedule_search capability? 

[Evgeny197]

How can I check that? "Settings" does not have it it seems

[isoutamo · Accepted solution]

Hi

Obviously you have normal user role or some non power/admin user role.

In normal case only admin or power user can create and run alerts.

As @marnall said you must have correct capability to create alerts. You should ask that from your Splunk Admins which may give it to you or not. That depends on your company policy who can create and run those.

r. Ismo

[Evgeny197]

Hi Ismo,

Thank you! I came to that conclusion yesterday and contacted the admins.

Regards,

Evgeny

[isoutamo]

Please mark some answer as Solution, so other people will see it later and get help!

[Evgeny197]

Hello Ismo,

I am able to create an alert, but it does not send the alerts to Slack.

I did check that the Slack Alert Setup has an updated "Slack App OAuth Token".

Are there any steps I am missing?

(By the way, if I chose email instead of Slack the alerts go through)

[isoutamo]

I haven’t use slack alert action, so I just give general hints.
Usually alert actions are written some log what happened into _internal index you should try to found something which is related to it.

[marnall]

Is the search a newly formed search or an edited Report? There should be an option for "Alert" when you make a new search and press "Save As", even in cloud.