Splunk Search

Is there a way to modify SID for alerting searches?

New Member

Hi,

I'm running alerts on quite a few scenarios across JVMs and servers and clusters to make sure logging is performing as expected.

The webhook works great, but it is painful to sort the alerts based on the SIDs generated by Splunk. Is there a way so set the SIDs for the alerting searches such that they are human readable and easier to parse?

0 Karma

New Member

To clairfy, I'm looking for something I can add to the searches generating the alerts that allows me to give them human readable IDs. One example would be setting the SID to ProdAlert1.

I'm also open to other ways of injecting information into the JSON returned.

0 Karma

Motivator

I don't know whether you can override SID. But you can sort SID

| rest /services/search/jobs | where isSavedSearch=1 | table latestTime sid label

Check below link,

http://docs.splunk.com/Documentation/Splunk/6.6.2/RESTREF/RESTsearch#search.2Fjobs

0 Karma

New Member

That is interesting, but I'm not looking to pull the SIDs from splunk, the SID is in the JSON

0 Karma