- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Alerts in Dashboard Panel
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm working on developing an app for a client, I'm looking to display the alerts that have fired (like it would appear in the alert manager). I've been playing with the Sideview Utils app, and displayed an iframe with the alert manager inside it, the problem with that is twofold, using the address as "localhost" doesn't work, and using the ip address does not lend to easy app deployment.
The other problem is that the header and the footer take up the iframe and don't let you see the alerts.
Any ideas?
Thank you in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As an alternative solution and depending on how creative you can get with your dashboards you can use the rest api directly from search to pull information about the alerts that have fired
run this search on your server that is sending the alerts as a starting point to see what kind of information is is able to provide
| rest count=0 /servicesNS/-/-/alerts/fired_alerts/
you can read more about it from here
http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTsearch
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As an alternative solution and depending on how creative you can get with your dashboards you can use the rest api directly from search to pull information about the alerts that have fired
run this search on your server that is sending the alerts as a starting point to see what kind of information is is able to provide
| rest count=0 /servicesNS/-/-/alerts/fired_alerts/
you can read more about it from here
http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTsearch
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad it works for you. There's all kinds of fun stuff you can do with the "| rest ..." command
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it too early to tell you I love you 🙂
Semi-Finalized search is:
| rest count=0 /servicesNS/-/-/alerts/fired_alerts/ | search eai:acl.app="search" | fields - eai*,published,splunk_server
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
