Scheduling and Alerts in Splunk

---

Creating a Scheduled Report

• priority places the report above other reports scheduled to run at the same time
• include a schedule window if the report doesn’t need to start a specific time and can be delayed
• Action allows you to send reports
  • can create custom actions

Managing Reports

• user with Power role can display a report for themselves or other Apps
• only Admin role can display a report for All Apps
• embedded report can be see by anyone with access to the webpage hosting the embedded report

Alerts

Alerts are based on searches that run on scheduled intervals or in real-time.

• can alert when the results of a search meet a defined condition
• triggered once the search is completed
• can:
  • list in Splunk interface
  • log events
    • sends event to Splunk deployment for indexing
  • send to telemetry endpoint
  • trigger scripts
  • send emails
  • use a webhook
  • run a custom alert

Creating Alerts

1. Create an alert by defining a Search
2. Save As > Alert
   • Permissions: Shared In App
     • Alert is displayed for all users of the App
     • by default everyone has read access
     • power users have write access

• two types:
  • scheduled
  • real-time
• Triggers:
  • Per-Result
  • Number of Results
  • Number of Hosts
  • Number of Sources
  • Custom conditions defined in Splunk Search Language
• Can trigger:
  • for each result
  • or once per the selected time
• Throttle
  • can suppress based off field values or time intervals

Using Alert Actions

• alert actions allow you to respond to triggered alerts
• Actions:
  • Triggered Alerts
    • sets severity
  • Log Event
    • sent to splunk deployment for indexing
  • Output results to Lookup
  • Output to Telemetry Endpoint
  • Run a Script
    • deprecated
    • use custom alert instead
  • Send Email
  • Webhook
    • define custom callbacks on a web resource
    • e.g., create ticket in support app
  • Manage Actions
    • create custom actions

Managing Alerts

• View triggered alerts: Activity > Triggered Alerts