View alerts in Splunk Observability Cloud

Learn how to view currently active alerts on the Alerts page or in the Infrastructure Navigator.

Alerts are highly relevant to the health of your services and applications. Splunk Observability Cloud shows alerts in all places where they matter, so that you don’t miss on important information.

You can view active alerts on the Alerts page, from charts and detectors, or access them from APM.

You can also view alerts from navigators, or use alerts to view navigators.

Review all active alerts in your organization

To review all the active alerts in your organization, go to Alerts > Active alerts. The Active alerts page shows the number of active alerts at each severity level, from critical to informative.

Active alert page

The summary cards provide a high-level count of active alerts categorized by their severity level:

  • Critical

  • Major

  • Minor

  • Warning

  • Info

The alert table displays the details of each active alert:

Column Name Description
Rule name Displays the name of the alert rule. AI-enhanced rules are marked with a specific label.
Source Displays the dimension that triggered the alert.
Detector Displays the name of the detector associated with the alert. Select the detector name to view its configuration details.
Teams Displays the teams associated with the detectors that triggered the alerts.
Triggered Indicates the date and time the alert was triggered.
Duration Displays how long the alert has been active.
Mute status Indicates if the alert is currently muted.
Actions Provides a menu to perform additional actions such as resolve and create muting rule on alerts.

The table lists all active alerts matching the conditions you’ve entered. If a notification for an alert is muted, a notification muted icon is displayed next to the alert. Use the search bar to find specific alert rules, or use the pagination controls to move through the results. Select the settings icon to show or hide table columns.

To see more details about the alert, select Rule name in the table. In the details dialog box, you can view the alert summary, root cause analysis (where applicable), select Resolve alert, open the detector that triggered the alert, and explore related items.

Active alert details
Note: If you can’t find an alert, apply a filter to reduce the number of matching alerts.

Filter alerts to reduce noise

You can refine the list of active alerts by using the following filter controls: to show only alerts that are relevant to specific tags or dimensions.

Filter Label Description
Time Range Selects the time frame for the displayed alerts. The default time frame is Last 8 days.
Severity Filters alerts by their assigned severity level such as Critical, Major, Minor, Warning, and Info.
Detector Filters alerts based on the specific detector that triggered them.
Teams Filters alerts based on teams associated with the detectors that triggered the alerts.
Origin Filters alerts by their source origin such as Standard, Autodetect, Customized Autodetect, and Service Level Objective.
Environment Filters alerts by the deployment environment.
Mute status Filters alerts based on whether they are currently muted.
Add filters Allows you to apply additional custom filters to the view.

To filter by service, endpoint, environment, or business transaction, set the APM Filters. Each filter defaults to All, displaying alerts across your entire environment until you select a specific value from the dropdown menu.

Filter Label Description
Service Filters the alert list to show only those associated with a specific service.
Endpoint Filters the alert list to show only those triggered by a specific API endpoint.
Business transaction Filters the alert list to show only those related to a specific business transaction.

Select Clear all to remove all the applied filters.

See which alerts are active for a detector

To view active alerts for a detector, go to the Alerts > Detectors page select a detector.

To open a detector, select its name. When you open a detector, a counter for each alert rule shows the number of active alerts that apply to the detector.

Alert counts in the detector details screen

Select any of the counters to view a list of active alerts for that rule. If there are multiple filters in the view, you can remove any of them to see a wider range of alerts for that detector.

Identify alerts from your charts

You can view alerts from charts or in the Infrastructure Navigator by browsing related detectors.

  1. Open the Detector menu by selecting the bell icon at the top right corner of a chart.

  2. Select an active alert or hover over a detector and select View Active Alerts to see all active alerts for that detector.

Active alerts inside the Detector menu

Find which service has active alerts in APM

To view active alerts for the services you’re monitoring in APM, go to APM > Overview. Active alerts appear in the Services and the Business transactions tabs under each service name.

Active alerts tab in APM

Select a service with an active alert to check how the service is affected.

Track crash rates using Signalflow

To set up alerts or dashboards on crash rates, compute them in SignalFlow by dividing the impacted count by the total count.

Use the programs in the SignalFlow editor for a Splunk Observability chart or detector.

  • .sum(over='<window>') accumulates the counter over a rolling window before dividing. Use '1d' for user metrics (daily cadence) and '1h' or shorter for session metrics.

  • .scale(100) converts the 0–1 ratio to a percentage.

  • Adjust the filter() and threshold() values to match your environment and SLO targets.

  • To group by dimensions such as app or OS version, add .sum(by=['app', 'os.name']) before dividing.