Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Improving Your Splunk Skills

You're reading from   Improving Your Splunk Skills Leverage the operational intelligence capabilities of Splunk to unlock new hidden business insights

Arrow left icon
Product type Course
Published in Aug 2019
Publisher Packt
ISBN-13 9781838981747
Length 680 pages
Edition 1st Edition
Languages
Tools
Arrow right icon
Authors (4):
Arrow left icon
James D. Miller James D. Miller
Author Profile Icon James D. Miller
James D. Miller
Josh Diakun Josh Diakun
Author Profile Icon Josh Diakun
Josh Diakun
Paul R. Johnson Paul R. Johnson
Author Profile Icon Paul R. Johnson
Paul R. Johnson
Derek Mock Derek Mock
Author Profile Icon Derek Mock
Derek Mock
Arrow right icon
View More author details
Toc

Table of Contents (21) Chapters Close

Title Page
Copyright and Credits About Packt Contributors Preface 1. The Splunk Interface 2. Understanding Search FREE CHAPTER 3. Tables, Charts, and Fields 4. Data Models and Pivots 5. Simple XML Dashboards 6. Extending Search 7. Working with Apps 8. Building Advanced Dashboards 9. Summary Indexes and CSV Files 10. Configuring Splunk 11. Play Time – Getting Data In 12. Building an Operational Intelligence Application 13. Diving Deeper – Advanced Searching, Machine Learning and Predictive Analytics 14. Speeding Up Intelligence – Data Summarization 15. Above and Beyond – Customization, Web Framework, HTTP Event Collector, REST API, and SDKs 1. Other Books You May Enjoy

Creating alerts from searches

Let's continue with our example. We want to take our original search query, schedule it, and then set a triggered response.

Any saved search can also be run on a schedule. One use for scheduled searches is firing alerts. Let's get started with our example. Go to the Reports page (shown in the previous screenshot) and click on Open in Search for our report (errors affecting mary). This opens our saved report not as a report but as a search query (it also runs the search). From there, we can click on Save As and choose Alert.

Using the Save As Alert window (shown in the next screenshot), we can fill in the appropriate details for our alert:

The fields can be filled as follows:

  • Title: I kept the original search title (errors affecting mary) but added the word alert
  • Description: I kept this the same, but in reality, we'd want to add more...
You have been reading a chapter from
Improving Your Splunk Skills
Published in: Aug 2019
Publisher: Packt
ISBN-13: 9781838981747
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image