So I've setup Splunk IT Service Intelligence (ITSI) and am interested in setting up Email Alerts with ITSI (if possible)
So far I've been looking into the Multi-KPIAlerts via: https://docs.splunk.com/Documentation/ITSI/2.5.1/User/CreateMulti-KPIAlerts. This creates correlated searches that ultimately create "Notable events" but what about email alerts?
I see the benefit of Multi-KPIAlerts but is there anyway to get an email sent each time a notable event is happens? Or is ITSI able to send out email alerts period?
According to this doc:
ITSI saves the alerts as a correlation search.
You can find the corresponding correlation search to your multiKPIAlert and add an email action there.
View solution in original post
@Jarohnimo - Did the answer provided by ehudb help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!