Create detectors to trigger alerts for logs

Use log-based detectors to run scheduled SPL searches and alert on matching log events.

Important:

This feature is being released as part of a phased roll out. Access is currently limited to a select group of accounts within specific realms and will be gradually expanded to all accounts across all realms. If you would like to request access to this feature, contact your account representative for further information.

Log-based alerting helps you create detectors in Splunk Observability Cloud that periodically run SPL searches against log data available through a Log Observer Connect connection. When the number of matching log events meets the configured condition, the detector fires an alert and uses existing Splunk Observability Cloud destinations to send notifications.

How log-based alerting works

A log-based detector contains one log alert rule. The rule defines the SPL search, count condition, clearing and suppression behavior, schedule, lookback period, message, criticality, and destinations.

Interactive searches and scheduled evaluations can run under different identities. Searches that you run while creating, editing, previewing, or investigating a detector use your current Splunk Observability permissions. To create, delete, update, or read log detectors, you must have the capabilities required for the corresponding operation:
  • CREATE_LOGS_DETECTOR
  • DELETE_LOGS_DETECTOR
  • UPDATE_LOGS_DETECTOR
  • READ_DETECTOR

Scheduled evaluations use the search runner configured for the selected connection.

See Create a log-based detector.

See Investigate a fired log-based alert.

See Log-based detector requirements and limits.

See Log-based detector access and ownership.

See Troubleshoot log-based detectors.