Alerts in Dashboard Panel

[tnconners]

I'm working on developing an app for a client, I'm looking to display the alerts that have fired (like it would appear in the alert manager). I've been playing with the Sideview Utils app, and displayed an iframe with the alert manager inside it, the problem with that is twofold, using the address as "localhost" doesn't work, and using the ip address does not lend to easy app deployment.

The other problem is that the header and the footer take up the iframe and don't let you see the alerts.

Any ideas?

Thank you in advance!

[cramasta · Accepted solution]

As an alternative solution and depending on how creative you can get with your dashboards you can use the rest api directly from search to pull information about the alerts that have fired

run this search on your server that is sending the alerts as a starting point to see what kind of information is is able to provide

| rest count=0 /servicesNS/-/-/alerts/fired_alerts/

you can read more about it from here

http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTsearch

[cramasta]

Glad it works for you. There's all kinds of fun stuff you can do with the "| rest ..." command

[tnconners]

Is it too early to tell you I love you 🙂

Semi-Finalized search is:
| rest count=0 /servicesNS/-/-/alerts/fired_alerts/ | search eai:acl.app="search" | fields - eai*,published,splunk_server