Splunk Enterprise

Alert manager enterprise - Creation of events in index

MCH2018
Explorer

Hello everyone,

I am encountering an issue with the Alert Manager Enterprise application; following the triggering of an alert, no event is created in my dedicated index. The status of the health check is okay, and we are able to create test events:

MCH2018_1-1699959010947.png

 


 Another point to note is that in the application's troubleshooting logs, when an alert is triggered, the event creation occurs but nothing is created in the index:

MCH2018_2-1699959028621.png

There are no permission issues, as I have confirmed by manually writing a search that we can create events in the index:

| makeresults | eval user="TEST", src="192.168.0.1", action="create test event" | sendalert create_alert param.title="Hello $result.user$" param.template=default

This successfully creates my event in my index. I have exhausted my troubleshooting ideas, do you have any suggestions on how to resolve this issue?

Thank you for your help.

MCH

Labels (2)
0 Karma
1 Solution

Datapunctum
Engager

Hi

There's a documentation bug for 2.0.0 as the tenant_uid has to be specified now.

The correct search would be:

| makeresults | eval user="World", src="192.168.0.1", action="create test event" | sendalert create_alert param.title="Hello $result.user$" param.template=default param.tenant_uid=default

 Hope this helps!

 

View solution in original post

Datapunctum
Engager

Hi

There's a documentation bug for 2.0.0 as the tenant_uid has to be specified now.

The correct search would be:

| makeresults | eval user="World", src="192.168.0.1", action="create test event" | sendalert create_alert param.title="Hello $result.user$" param.template=default param.tenant_uid=default

 Hope this helps!

 

MCH2018
Explorer

Hello

Thank you, that indeed solved my issue. I also noticed that there are some screenshots in your documentation that are not up to date. It would be worth updating it for other users.

Thanks again for your response!

0 Karma

_JP
Contributor

I don't have your answer...but it might be helpful to cross-post your question here:

Alert Manager Enterprise - Splunk Community

 

That is the "place" where questions about the Alert Manager Enterprise app on Splunkbase would go now, but I don't think there is any way to link this post with app right now.

Also, the folks at Datapunctum AG might have their eyes on that area for there app, and not here, for answering any questions.  

I'm going to tag one person I know at Datapunctum that I think worked on this app:  @my2ndhead 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...