Alerts

Key Concepts

• Alerts are saved searches that run on a schedule or in real-time and trigger actions when conditions are met
• Created from the Search & Reporting app by saving a search as an alert
• Two trigger types: Scheduled (runs at defined intervals) and Real-time (continuous monitoring)
• Alert conditions define when the alert fires: number of results, custom condition, field value, etc.
• Alert actions include: Send Email, Run Script, Add to Triggered Alerts, Use a Webhook, and others via add-ons
• Alerts are stored in the Triggered Alerts dashboard (Activity > Triggered Alerts)
• Alert severity levels: Info, Low, Medium, High, Critical
• Throttling prevents alert fatigue by suppressing repeated alerts for a defined time period or per field value

How It Works

1. A saved search runs on a schedule (e.g., every 5 minutes, hourly, cron expression) or in real-time
2. Splunk evaluates the trigger condition against search results
3. If condition is met, the alert fires and executes configured actions
4. Throttle settings control whether the alert fires again immediately or waits
5. Triggered alerts are logged and visible in the Triggered Alerts page for 24 hours by default

Commands / Syntax / Key Values

Exam Gotchas

• Real-time alerts ≠ scheduled alerts — Real-time runs continuously but is resource-intensive; exam questions may try to swap these concepts
• "Per Result" throttling — Throttling by field value (e.g., suppress per host) means each unique value is tracked separately; a common confusion point with global throttle
• Triggered Alerts vs Alert Actions — "Add to Triggered Alerts" is itself an action you must explicitly enable; alerts don't automatically appear there unless this action is selected
• Scheduled alert timing — If you choose a cron schedule, the search runs over the time window you define, not just at that moment; students often confuse schedule time with search time range
• Permissions matter — An alert saved as Private is only visible to its owner; sharing to App makes it available to other users in that app — exam may test who can see/edit alerts

Quick Summary

Alerts in Splunk are saved searches that run on a schedule or in real-time and fire actions (email, webhook, script, etc.) when a defined trigger condition is met. The key settings to master are: trigger condition (what makes it fire), throttle (how often it can re-fire), and actions (what happens when it fires). Remember that "Add to Triggered Alerts" must be explicitly selected as an action, real-time alerts are continuous and resource-heavy, and alert visibility depends on permission settings (Private vs App vs Global).