Splunk Enterprise

Option to rerun expired results_link ?

jwv
Explorer

When alerting sends the $results_link$ token, the link expires relatively quickly, and as the owner of the alert when I click on it I get the option to rerun the search. No one else seems to get that option when they click on the expired link. Can this option be enabled for everyone? And why is it that only I am seeing it? 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Why you need to rerun it later? There is some things what you need to ensure in your alert and it's search span etc. to ensure that you will get (almost) same results when you rerun it. There is also possibility that e.g. some delayed events has indexed after original run and then you will get different result when you are rerunning it.

IMHO: If the default time is not enough you should extend that in Alert configuration. Then you don't need to adjust all those stuff to ensuring that rerun gives you a same results than 1st run has given.

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @jwv 

If you're the owner then this is why you get the option to re-run it.

I think If you were to change the dispatchAs setting for the search to 'user' instead of 'owner' then it *might* allow others to rerun it, although I havent tested this recently.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...