Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Enterprise
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Splunk Platform
- :
- Splunk Enterprise
- :
- Re: How to display alerts with in drop-down option...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kk
Path Finder
03-16-2022
07:48 AM
Hi everyone, Just wanted to know how to show alert dynamically like we use dashboard panel to search query for every drop-down option likewise is it possible to show how many alerts are occured with in that period for that drop down option in dashboard panel?
Please help me out with this thing.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
aasabatini
Motivator
03-16-2022
08:21 AM
Hi @Kk
can you create a dropdown input panel based on this search
| rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count
this search display all triggered alerts present on your search head
Also you can check this dashboard
<row>
<panel>
<table>
<title>Alerts Fired</title>
<search>
<query>index=_audit action=alert_fired |rename ss_name AS Alert
|stats latest(_time) AS "Last Fired" count AS "Times Fired" sparkline AS "Alerts in the Last 72 Hours"
first(sid) AS sid by Alert
|convert ctime("Last Fired")</query>
<earliest>-72h</earliest>
<latest>now</latest>
<refresh>90s</refresh>
</search>
<fields>Alert, "Last Fired", "Times Fired", "Alerts in the Last 72 Hours"</fields>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">heatmap</option>
<option name="count">10</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.openSearch.visible">false</option>
<format field="Alerts in the Last 72 Hours" type="sparkline">
<option name="type">bar</option>
<option name="barColor">green</option>
<option name="colorMap">
<option name="1:3">navy</option>
<option name="3:7">orange</option>
<option name="8:">red</option>
</option>
</format>
<drilldown target="_blank">
<link>search?sid=$row.sid$</link>
</drilldown>
<option name="drilldown">cell</option>
</table>
<html>
<p>
Location specific instructions in html
</p>
</html>
</panel>
</row>
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kk
Path Finder
03-16-2022
08:53 AM
That's too detailed one. Thank you @aasabatini
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
aasabatini
Motivator
03-16-2022
08:21 AM
Hi @Kk
can you create a dropdown input panel based on this search
| rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count
this search display all triggered alerts present on your search head
Also you can check this dashboard
<row>
<panel>
<table>
<title>Alerts Fired</title>
<search>
<query>index=_audit action=alert_fired |rename ss_name AS Alert
|stats latest(_time) AS "Last Fired" count AS "Times Fired" sparkline AS "Alerts in the Last 72 Hours"
first(sid) AS sid by Alert
|convert ctime("Last Fired")</query>
<earliest>-72h</earliest>
<latest>now</latest>
<refresh>90s</refresh>
</search>
<fields>Alert, "Last Fired", "Times Fired", "Alerts in the Last 72 Hours"</fields>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">heatmap</option>
<option name="count">10</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.openSearch.visible">false</option>
<format field="Alerts in the Last 72 Hours" type="sparkline">
<option name="type">bar</option>
<option name="barColor">green</option>
<option name="colorMap">
<option name="1:3">navy</option>
<option name="3:7">orange</option>
<option name="8:">red</option>
</option>
</format>
<drilldown target="_blank">
<link>search?sid=$row.sid$</link>
</drilldown>
<option name="drilldown">cell</option>
</table>
<html>
<p>
Location specific instructions in html
</p>
</html>
</panel>
</row>
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!
CX Day is Coming!
Customer Experience (CX) Day is on October 7th!!
We're so excited to bring back another day full of wonderful ...
Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!
The Big One: Splunk 10 is Here!
The moment many of you have been waiting for has arrived! We are thrilled to ...
Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console
Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...
