![]() ![]() In this case, the alert sends an email notification when it triggers. The following example shows the stanza for a saved search with its alert action settings. Meaning, if scheduler is busy at 9:00 AM, it will still try to run your alert at 9:01 AM or 9:02 AM. For example, let's say you scheduled your alert to run at 9:00 AM with a schedule window of 2 (minutes), the scheduler will keep 2 minute window open for the alert to run. Create or edit the stanza for the saved search. Open or create a nf file in the proper directory. Make changes to the files in the local directory. ![]() nf contains a stanza for each saved search. It specifies that 'window' of time (in minutes) a search may start within. The files in the default directory must remain intact and in their original location. Open or create a local nf file at $SPLUNK_HOME/etc/system/local.įor apps, open or create the nf file in the application directory: $SPLUNK_HOME/etc/apps//local Example nf stanzaĪlerts use a saved search to look for events. Create or edit the stanza for the saved search.Open or create a nf file in the proper directory.The specific output differs depending upon what you have installed, but it includes nf and nf from devtutorial, along with many other conf files. raw will contain the search name and the field 'search' will have the search string. You can use it to tell splunk to use the rest endpoint to collect the saved searches. Make changes to the files in the local directory. Splunk software configuration files, also referred to as conf files, make up a working set of configurations that are used by Splunk software when performing tasks. app (written by carasso) from splunkbase, it includes a new search command entity. The files in the default directory must remain intact and in their original location. Never change or copy the configuration files in the default directory. ![]() Read Where you can place (or find) your modified configuration files in the Splunk Enterprise Admin Manual.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |