Splunk Search

How to automatically rerun failed alerts

codedtech
Path Finder

Hi,  I have 14 alerts that cover all the infrastructure, my company uses. I get my data from a data bus every 60 minutes, but when that fails and it can for (several hours at a time). I would like to not have to rerun the alerts manually. As a note I don't any elevated access to the Splunk instance or the environment so I can't install apps, add-ins, or update any conf files, but I do have access to the audit and internal indexes. 

Ideally I'd like my conditional trigger to be something like this:
index=_internal sourcetype=scheduler status=!success savedsearch_name="Stuff to search"
| table _time search_type status user app savedsearch_name result_count
|where result_count=0  then <search/commands to rerun alert every hour until results are in>

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

SPL doesn't have conditional execution commands.  Go to https://ideas.splunk.com to suggest them.

Failed alerts will re-run at the next interval.

---
If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!