Splunk Search

Splunk query

Gayathirik
Path Finder

Hi

I need to write a query for creating an alert whenever there is message in the "Splunk bar" message tab.

Please help me with this.

Tags (1)
0 Karma
1 Solution

WalshyB
Path Finder
0 Karma

renjith_nair
SplunkTrust
SplunkTrust
  • Write a search to find the message in Splunk bar
  • Save as alert
  • Select the schedule of the alert
  • Under trigger conditions select Number of Results and then is greater than 0 option
  • Select your trigger actions

Reference :

http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/AlertWorkflowOverview
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Definescheduledalerts

Happy Splunking!
0 Karma

Gayathirik
Path Finder

am clear about the process of creating an alert. Could you please help me in writing the splunk query whenever we get a pop up message in the splunk message tab?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Alright !

Try this

| rest /services/messages| table title message severity timeCreated_iso published splunk_server author 
Happy Splunking!

Gayathirik
Path Finder

This doesnt meet my requirement.

My issue here is For example: in the message tab some warning or error message like "indexer is down or too many streamings to the target" is popped out then the same thing has to be triggered as an alert whenever there is a message pop up in splunk bar.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There is no list of these messages. But you should be able to find these in the "_internal" index. Create alerts for these as you would a normal event.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...