Splunk Search

How to automatically rerun failed alerts

codedtech
Path Finder

Hi,  I have 14 alerts that cover all the infrastructure, my company uses. I get my data from a data bus every 60 minutes, but when that fails and it can for (several hours at a time). I would like to not have to rerun the alerts manually. As a note I don't any elevated access to the Splunk instance or the environment so I can't install apps, add-ins, or update any conf files, but I do have access to the audit and internal indexes. 

Ideally I'd like my conditional trigger to be something like this:
index=_internal sourcetype=scheduler status=!success savedsearch_name="Stuff to search"
| table _time search_type status user app savedsearch_name result_count
|where result_count=0  then <search/commands to rerun alert every hour until results are in>

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

SPL doesn't have conditional execution commands.  Go to https://ideas.splunk.com to suggest them.

Failed alerts will re-run at the next interval.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...