Alerting

Customise alerts with configurable parameters dependant on asset/app/host

ebs
Communicator

Is there a way to create a sort of catch-all base search/alert and then have customisable configurable parameters dependant on asset/app/host/criticality? If possible I'd rather not create 10s of alerts dependant on the various factors listed above but I'm not sure if there's a way to do it otherwise

 

e.g. 'too many login fails per X minutes' to have a configurable value for 'too many' depending on the asset / host /app details (i.e. we would like one use-case to cover "too many failed logins" (and other common cases) across lots of apps without copying the case over and over

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...