Splunk Enterprise

Is there an easy way to implement a recovery alert in the same query as the alert query?

croseberry
Engager

Is there an easy way to implement a recovery alert in the same query as the alert query?

For example if I have a system that creates a log file every 10 min if everything is working. I built a query that runs every half an hour and tells me if there is something new in the log location. That part is easy enough but I would also like the same query to be able to send a recovery notification.

Or is this not going to be possible because I want to trigger two different actions because from what I can tell you can only configure the one email or slack action per alert? 

I did see that there is a splunk addon with VictorOps that has this functionality but I wanted to check here first before I went down that route.



Labels (1)
0 Karma

Roy_9
Motivator

@croseberry interesting one! following

Sharing the below one, which might help.

https://splunkonbigdata.com/sending-multiple-alerts-based-upon-multiple-conditions-using-one-alert-i...

Thanks

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...