Splunk Enterprise

How to display alerts with in drop-down options?

Kk
Path Finder

Hi everyone, Just wanted to know how to show alert dynamically like we use  dashboard panel to search query for every drop-down option likewise is it possible to show how many alerts are occured with in that period  for that drop down option in dashboard panel?

Please help me out with this thing.

Labels (1)
Tags (2)
0 Karma
1 Solution

aasabatini
Motivator

Hi @Kk 

 

can you create a dropdown input panel based on this search

	
| rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count

 

this search display all triggered alerts present on your search head

 

Also you can check this dashboard

 

<row>
<panel>
<table>
<title>Alerts Fired</title>
<search>
<query>index=_audit action=alert_fired |rename ss_name AS Alert 
|stats latest(_time) AS "Last Fired" count AS "Times Fired" sparkline AS "Alerts in the Last 72 Hours" 
first(sid) AS sid by Alert 
|convert ctime("Last Fired")</query>
<earliest>-72h</earliest>
<latest>now</latest>
<refresh>90s</refresh>
</search>
<fields>Alert, "Last Fired", "Times Fired", "Alerts in the Last 72 Hours"</fields>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">heatmap</option>
<option name="count">10</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.openSearch.visible">false</option>
<format field="Alerts in the Last 72 Hours" type="sparkline">
<option name="type">bar</option>
<option name="barColor">green</option>
<option name="colorMap">
<option name="1:3">navy</option>
<option name="3:7">orange</option>
<option name="8:">red</option>
</option>
</format>
<drilldown target="_blank">
<link>search?sid=$row.sid$</link>
</drilldown>
<option name="drilldown">cell</option>
</table>
<html>
<p>
Location specific instructions in html
 
</p>
</html>
</panel>
</row>
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

0 Karma

Kk
Path Finder

That's too detailed one. Thank you @aasabatini 

0 Karma

aasabatini
Motivator

Hi @Kk 

 

can you create a dropdown input panel based on this search

	
| rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count

 

this search display all triggered alerts present on your search head

 

Also you can check this dashboard

 

<row>
<panel>
<table>
<title>Alerts Fired</title>
<search>
<query>index=_audit action=alert_fired |rename ss_name AS Alert 
|stats latest(_time) AS "Last Fired" count AS "Times Fired" sparkline AS "Alerts in the Last 72 Hours" 
first(sid) AS sid by Alert 
|convert ctime("Last Fired")</query>
<earliest>-72h</earliest>
<latest>now</latest>
<refresh>90s</refresh>
</search>
<fields>Alert, "Last Fired", "Times Fired", "Alerts in the Last 72 Hours"</fields>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">heatmap</option>
<option name="count">10</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.openSearch.visible">false</option>
<format field="Alerts in the Last 72 Hours" type="sparkline">
<option name="type">bar</option>
<option name="barColor">green</option>
<option name="colorMap">
<option name="1:3">navy</option>
<option name="3:7">orange</option>
<option name="8:">red</option>
</option>
</format>
<drilldown target="_blank">
<link>search?sid=$row.sid$</link>
</drilldown>
<option name="drilldown">cell</option>
</table>
<html>
<p>
Location specific instructions in html
 
</p>
</html>
</panel>
</row>
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...