Splunk Enterprise

Is there an easy way to implement a recovery alert in the same query as the alert query?

croseberry
Engager

Is there an easy way to implement a recovery alert in the same query as the alert query?

For example if I have a system that creates a log file every 10 min if everything is working. I built a query that runs every half an hour and tells me if there is something new in the log location. That part is easy enough but I would also like the same query to be able to send a recovery notification.

Or is this not going to be possible because I want to trigger two different actions because from what I can tell you can only configure the one email or slack action per alert? 

I did see that there is a splunk addon with VictorOps that has this functionality but I wanted to check here first before I went down that route.



Labels (1)
0 Karma

Roy_9
Motivator

@croseberry interesting one! following

Sharing the below one, which might help.

https://splunkonbigdata.com/sending-multiple-alerts-based-upon-multiple-conditions-using-one-alert-i...

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...