Splunk Search

How to prevent Splunk triggered alerts to be deleted when Splunk is restarted?

Path Finder

I've created an alert for Account Expired. 

However, the triggered alert disappears when I do a splunk restart.  

Is there any way to prevent this alert from disappearing?  Any config setting?

In case you wanted to know the alert information:

-  Settings:

    - Alert Type = Scheduled

    - Runs every day at 23:00

    - Expires 24 hours

- Trigger Conditions

   - Trigger alert when Number of Results is greater than 0

   - Trigger Once

- Trigger Action

   - Add to Triggered Alerts with Severity Critical

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...