Alerting

Where do you package your alert_actions.conf for Splunk ES?

daniel333
Builder

All,

I know Splunk ES is a little picky about apps installed with it and created. I was going to create an app called mycompany_splunkes_base and toss in all my configs like server.conf and alert_actions.conf there. Any reason that would be a bad idea?

0 Karma

starcher
SplunkTrust
SplunkTrust

If you are making alert actions for ES use add on builder and make proper additive responses.

http://www.georgestarcher.com/splunk-slides-addon-builder-and-alert-actions/

Also name any apps like TA-myapp or SA-myapp so you don’t gave to edit the ES app filter to import it.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...