Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Splunk Enterprise
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Splunk Answers
- :
- Splunk Platform Products
- :
- Splunk Enterprise
- :
- Re: How to display alerts with in drop-down option...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kk
Path Finder
03-16-2022
07:48 AM
Hi everyone, Just wanted to know how to show alert dynamically like we use dashboard panel to search query for every drop-down option likewise is it possible to show how many alerts are occured with in that period for that drop down option in dashboard panel?
Please help me out with this thing.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
aasabatini
Motivator
03-16-2022
08:21 AM
Hi @Kk
can you create a dropdown input panel based on this search
| rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count
this search display all triggered alerts present on your search head
Also you can check this dashboard
<row>
<panel>
<table>
<title>Alerts Fired</title>
<search>
<query>index=_audit action=alert_fired |rename ss_name AS Alert
|stats latest(_time) AS "Last Fired" count AS "Times Fired" sparkline AS "Alerts in the Last 72 Hours"
first(sid) AS sid by Alert
|convert ctime("Last Fired")</query>
<earliest>-72h</earliest>
<latest>now</latest>
<refresh>90s</refresh>
</search>
<fields>Alert, "Last Fired", "Times Fired", "Alerts in the Last 72 Hours"</fields>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">heatmap</option>
<option name="count">10</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.openSearch.visible">false</option>
<format field="Alerts in the Last 72 Hours" type="sparkline">
<option name="type">bar</option>
<option name="barColor">green</option>
<option name="colorMap">
<option name="1:3">navy</option>
<option name="3:7">orange</option>
<option name="8:">red</option>
</option>
</format>
<drilldown target="_blank">
<link>search?sid=$row.sid$</link>
</drilldown>
<option name="drilldown">cell</option>
</table>
<html>
<p>
Location specific instructions in html
</p>
</html>
</panel>
</row>
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kk
Path Finder
03-16-2022
08:53 AM
That's too detailed one. Thank you @aasabatini
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
aasabatini
Motivator
03-16-2022
08:21 AM
Hi @Kk
can you create a dropdown input panel based on this search
| rest /services/alerts/fired_alerts splunk_server=local| table eai:acl.owner eai:acl.app id title triggered_alert_count
this search display all triggered alerts present on your search head
Also you can check this dashboard
<row>
<panel>
<table>
<title>Alerts Fired</title>
<search>
<query>index=_audit action=alert_fired |rename ss_name AS Alert
|stats latest(_time) AS "Last Fired" count AS "Times Fired" sparkline AS "Alerts in the Last 72 Hours"
first(sid) AS sid by Alert
|convert ctime("Last Fired")</query>
<earliest>-72h</earliest>
<latest>now</latest>
<refresh>90s</refresh>
</search>
<fields>Alert, "Last Fired", "Times Fired", "Alerts in the Last 72 Hours"</fields>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">heatmap</option>
<option name="count">10</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.openSearch.visible">false</option>
<format field="Alerts in the Last 72 Hours" type="sparkline">
<option name="type">bar</option>
<option name="barColor">green</option>
<option name="colorMap">
<option name="1:3">navy</option>
<option name="3:7">orange</option>
<option name="8:">red</option>
</option>
</format>
<drilldown target="_blank">
<link>search?sid=$row.sid$</link>
</drilldown>
<option name="drilldown">cell</option>
</table>
<html>
<p>
Location specific instructions in html
</p>
</html>
</panel>
</row>
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!
.conf24 | Registration Open!
Hello, hello! I come bearing good news: Registration for .conf24 is now open!
conf is Splunk’s rad annual ...
ICYMI - Check out the latest releases of Splunk Edge Processor
Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.
HEC Receiver authorization ...
Introducing the 2024 SplunkTrust!
Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!
The ...
