I would like to have a report emailed to me a few minutes after an alert goes off.  While the alert can include the results, it is based on something specific and will not have all the information I need.  Let's say the alert is set up to catch too many host communication  errors to a specific endpoint.  Errors>100.  Currently I either go to the alert and alter it to make a time chart to see any trends, or go to a specific dashboard that shows communication errors with other endpoints, network status, response times, etc.  When the problem goes away I take all the Splunk graphs and make an incident report.   I would like to have a report with graphs and other info based on the dashboard emailed to me at the time of the alert and 10 minutes after.   Sometimes I can get to my email, but not to Splunk.   This would also help with the incident report and make them more uniform.  Is this possible?  I have not worked with reports much.  Can a report be triggered by a separate search?  I could not find that answer online so I believe it can't.  I could write a query that looks at the last time an alert went off and have that trigger the associated report if possible.  I would like some type of PDF that I can just attach to the incident report.  More importantly I would like to have much more detail emailed to me after an alert.  I'm not even sure what an emailed report looks like.  I could google that, but If I can't trigger it there is no need for the report.  Although in reading about reports I want to use them more with dashboards.  Thanks          ... View more

I wrote a program that uses the Splunk API to modify alerts.  I tested this on one of my alerts and it worked fine.  When I ran this against an alert that was owned by a splunk service account it created a new alert that was identical (identical name too) to the one I wanted to modify except the owner is now me.   In the API call I only provided the name of the alert and the section of the alert I wanted changed.   It looks to have duplicated the rest from the existing alert.   I also used a token associated with my username.     When I look in the alerts menu I only see the original alert.   I need to use a search query (|rest/servicesNS/-/-/saved/searches | search alert.track=1...) to see the other alert.   1)  How do I delete the duplicate alert?  It does not appear under my alerts either.  I don't have access to the machine.  I could request help from someone that does though.       2)  To modify an alert owned by someone else through the API do I need a token generated from their account?  I can edit the alert through the GUI. Thanks. Scott ... View more