Splunk Enterprise Security

Triggered event (staging mode)

havatz
Explorer

Hey all

When Im creating a new scheduled search for customer .. there is any option to save the trigged alert to specific index or another place ? I don't want that the customer will see the rules as fired and the notable triggered alert.

I just want to check the rule as staging .. and get the triggered alert to another place that is not notable index or something that the customer can check. there is any solution that is not by sending  mail?

Labels (1)
0 Karma

saravanan90
Contributor

We can create a scheduled search & save the results to separate index by using collect command in Splunk.

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Collect

 

-----------------

An upvote would be appreciated if the above comment helps.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!