splunk-alert
starsforks
How to install splunk-alert?
grandcamel/splunk-assistant-skills/splunk-alert
$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-alertAlert triggering, monitoring, and notification management for Splunk.
SKILL.md
| 1 | # splunk-alert |
| 2 | |
| 3 | Alert triggering, monitoring, and notification management for Splunk. |
| 4 | |
| 5 | ## Purpose |
| 6 | |
| 7 | Create and manage alerts, monitor triggered alerts, and configure alert actions. |
| 8 | |
| 9 | ## Risk Levels |
| 10 | |
| 11 | | Operation | Risk | Notes | |
| 12 | |-----------|------|-------| |
| 13 | | List alerts | - | Read-only | |
| 14 | | Get alert details | - | Read-only | |
| 15 | | List triggered alerts | - | Read-only | |
| 16 | | Create alert | ⚠️ | May trigger notifications | |
| 17 | | Update alert | ⚠️ | Previous config lost | |
| 18 | | Acknowledge alert | ⚠️ | Can be re-triggered | |
| 19 | | Delete alert | ⚠️⚠️ | May be recoverable from backup | |
| 20 | |
| 21 | ## Triggers |
| 22 | |
| 23 | - "alert", "trigger", "notification" |
| 24 | - "monitor", "alerting" |
| 25 | |
| 26 | ## CLI Commands |
| 27 | |
| 28 | | Command | Description | |
| 29 | |---------|-------------| |
| 30 | | `alert create` | Create a new alert | |
| 31 | | `alert get` | Get alert details | |
| 32 | | `alert list` | List all alerts (scheduled searches with alert actions) | |
| 33 | | `alert triggered` | List triggered alerts | |
| 34 | | `alert acknowledge` | Acknowledge a triggered alert | |
| 35 | |
| 36 | ## Examples |
| 37 | |
| 38 | ```bash |
| 39 | # Create an alert |
| 40 | splunk-as alert create --name "High Error Rate" \ |
| 41 | --search "index=main sourcetype=app_logs error | stats count" \ |
| 42 | --condition "number of events" \ |
| 43 | --comparator "greater than" \ |
| 44 | --threshold 100 \ |
| 45 | --cron "*/5 * * * *" \ |
| 46 | --actions email \ |
| 47 | --email-to ops@example.com |
| 48 | |
| 49 | # List all configured alerts |
| 50 | splunk-as alert list --app search --count 100 |
| 51 | |
| 52 | # Get specific alert details |
| 53 | splunk-as alert get "High Error Rate" |
| 54 | |
| 55 | # List triggered alert instances with filters |
| 56 | splunk-as alert triggered --app search --count 20 |
| 57 | |
| 58 | # Acknowledge/delete a triggered alert |
| 59 | splunk-as alert acknowledge alert_12345 |
| 60 | ``` |
| 61 | |
| 62 | ## Alert Configuration |
| 63 | |
| 64 | ### Severity Levels |
| 65 | |
| 66 | - 1 = debug |
| 67 | - 2 = info |
| 68 | - 3 = warn (default) |
| 69 | - 4 = error |
| 70 | - 5 = severe |
| 71 | - 6 = fatal |
| 72 | |
| 73 | ### Alert Types |
| 74 | |
| 75 | - `always` - Trigger on every scheduled execution |
| 76 | - `number of events` - Trigger when result count meets condition |
| 77 | - `number of hosts` - Trigger when host count meets condition |
| 78 | - `number of sources` - Trigger when source count meets condition |
| 79 | - `custom` - Custom alert condition |
| 80 | |
| 81 | ### Alert Comparators |
| 82 | |
| 83 | - `greater than` |
| 84 | - `less than` |
| 85 | - `equal to` |
| 86 | - `not equal to` |
| 87 | - `drops by` |
| 88 | - `rises by` |
| 89 | |
| 90 | ### Alert Actions |
| 91 | |
| 92 | - `email` - Send email notification |
| 93 | - `webhook` - HTTP POST to webhook URL |
| 94 | - `script` - Execute custom script |
| 95 | - Custom actions configured in Splunk |
| 96 | |
| 97 | ## API Endpoints |
| 98 | |
| 99 | - `GET /services/alerts/fired_alerts` - List triggered alerts |
| 100 | - `GET /services/alerts/fired_alerts/{name}` - Get specific triggered alert |
| 101 | - `DELETE /services/alerts/fired_alerts/{name}` - Acknowledge/delete triggered alert |
| 102 | - `POST /servicesNS/nobody/{app}/saved/searches` - Create alert (via saved search) |
| 103 | - `GET /servicesNS/nobody/{app}/saved/searches` - List alert configurations |
People who liked this also viewed
6 picksType
- azure-kustoQuery and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clustersSkillsJul 2026
- lark-base飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark-drive，认证/授权转 lark-shared。SkillsJul 2026
- lark-calendar飞书日历：管理日历日程和会议室。查看/搜索日程、创建/更新日程、管理参会人、查询忙闲和推荐时段、预定会议室。当用户需要查看日程安排、创建/修改会议、查询/预定会议室时使用。不负责：查询过去的视频会议记录（走 lark-vc）、待办任务（走 lark-task）。SkillsJul 2026
- shadcnManages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. AppliSkillsJul 2026
- xlsxUse this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.SkillsJul 2026
- firebase-data-connectAgent Skills for FirebaseSkillsJul 2026
