Throughout the previous chapters in this book, you have created a great deal of Splunk searches, including historic searches that look back over time and real-time searches. In this chapter, you will learn about alerting, arguably one of Splunk's most powerful features.
A key part of gaining complete operational intelligence is the ability to be proactive rather than reactive. Periodic, ad hoc searching of the data for certain conditions might provide some operational insight, but a better approach would be to continually monitor the data and know immediately when certain conditions are met. For example, instead of reacting to a network outage after it has occurred, it would be better to proactively look for the factors that could lead to a network outage and prevent it from occurring in the first place. It is this type of proactive approach that Splunk&apos...
