a-l-h / splunk-app-proper-alerts

A Splunk App to keep track on configured alerts.

Proper Alerts

Version

1.2.2

Date

19 May 2022

Release Notes

• Fixed issues in 'Find' dashboard

Documentation

Read the Docs

Prerequisites

These Apps must be deployed to your Search Head(s):

• Python Cron Iteration
• Lookup File Editor

Deployment Steps

1. Install the App on your Splunk Search Head(s)
2. Launch Update KV Store lookup from Reports tab by clicking Open in Search
3. Verify that active alerts are listed in the Inventory dashboard
4. [OPT] Adjust getServiceRequest macro to extract service request # from alerts' description
5. Set recipient to Notify admin for alerts to review alert
6. [WARN] Set recipient to Notify alert recipient of a change alert as $result.email$

⚠️ Notify alert recipient of a change alert will send an email to alert’s recipient when triggered

Upgrade

Relaunch Update KV Store lookup from Reports tab by clicking Open in Search

⚠️ As 'type' is a new KV Store field, a change will be detected for all alerts, hence if you are using the 'Notify alert recipient of a change' alert, silence its first execution after the upgrade

Contact

a-l-h