All Apps and Add-ons

Alert Manager: How to assign a priority based on search?

redacted
Explorer

How to assign a priority based on search?

Is it possible to assign a priority based on a search, similar to the way you can assign a user? Or used to be able to as per: https://answers.splunk.com/answers/426909/alert-manager-how-to-assign-a-certain-incident-to.html

Thanks

1 Solution

redacted
Explorer

from the alert manager gui

Default urgency for incidents of this alert.
Note: The urgency can be overriden by a field from search results named 'urgency'. Later, the alert manager calculates a priority based on the impact and urgency.

View solution in original post

0 Karma

redacted
Explorer

from the alert manager gui

Default urgency for incidents of this alert.
Note: The urgency can be overriden by a field from search results named 'urgency'. Later, the alert manager calculates a priority based on the impact and urgency.

0 Karma

redacted
Explorer

so far I have been able to get this

index=main name=bad thing threat>=80 threat<=100 ( alert is created high)
index=main name=bad thing threat>=40 threat<=79 (alert is created med)
index=main name=bad thing threat>=0 threat<=39 (alert is created low)

the threat is a field that I am parsing in my alert search query, unfortunately I have to use 3 searches if not 5 for all of the alert manager "priority" options on the incident posture

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...