All Apps and Add-ons

Alert Manager: Why are Triggered Alerts not showing in the Incident Settings of the app?

leonheart78
Explorer

I have installed the Alert Manager app and triggered an Alert through my savedsearch. I have ensured that the permission of the Alert is set to Global, and Read permission to All Apps and Everyone.

However, I'm unable to see any trigger alerts in the Alert Manager App. Pls help.

Tags (2)
0 Karma
1 Solution

korstiaan
Explorer

Hi I think you have 2 options at the moment if you have Splunk 6.3 download the new app:
https://splunkbase.splunk.com/app/2665/#/overview the new app in combination with Splunk 6.3 uses alert actions this is a lot easier to setup.

If you are still on the old alert manager app or on Splunk < 6.3 make sure you read this part about the installation: https://github.com/simcen/alert_manager#installation
Basically you have to create a link between the .py script from alert manager and the script directory of Splunk so that the Alert script will catch the new alerts.
Hope this helps.

View solution in original post

0 Karma

korstiaan
Explorer

Hi I think you have 2 options at the moment if you have Splunk 6.3 download the new app:
https://splunkbase.splunk.com/app/2665/#/overview the new app in combination with Splunk 6.3 uses alert actions this is a lot easier to setup.

If you are still on the old alert manager app or on Splunk < 6.3 make sure you read this part about the installation: https://github.com/simcen/alert_manager#installation
Basically you have to create a link between the .py script from alert manager and the script directory of Splunk so that the Alert script will catch the new alerts.
Hope this helps.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...