Alerting

Are there any known drawbacks for using the auto window when scheduling non real-time alerts?

danielbb
Motivator

I wonder whether there are any known issues with using the auto window capability when scheduling non real-time alerts? In my mind, it should be the default and I just wonder if there are any arguments why it shouldn't be?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Only what you would expect: some will run late so, for example, if you are looking at a dashboard driven by a scheduled search running every 5-minutes and you have <dashboard refresh=600> at the top, because it is on a very fixed schedule, you may not see your changes until the refresh after you normally would.

danielbb
Motivator

The main focus here is about the alerts. Since we have many cyber alerts, some people have concerns and are not rushing to embrace this promising auto feature. It's interesting whether there is any tracking of the auto driven alerts, meaning, the delta, the actual execution time, etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...