Triggered event (staging mode)

[havatz]

Hey all

When Im creating a new scheduled search for customer .. there is any option to save the trigged alert to specific index or another place ? I don't want that the customer will see the rules as fired and the notable triggered alert.

I just want to check the rule as staging .. and get the triggered alert to another place that is not notable index or something that the customer can check. there is any solution that is not by sending  mail?

[saravanan90]

We can create a scheduled search & save the results to separate index by using collect command in Splunk.

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Collect

-----------------

An upvote would be appreciated if the above comment helps.