Create a log-based detector

Create a detector that periodically runs an SPL search and fires an alert based on the number of matching events.

Confirm that your Splunk Observability Cloud environment has a supported Unified Identity or Log Observer Connect configuration. You also need access to the connection and log data used by the search, and capability (CREATE_LOGS_DETECTOR) to create log alerts.

A log-based detector contains one log alert rule. An organization can retain up to 50 log-based detectors.

  1. Go to Alerts > Detectors.
  2. Select Create detector, then select Log-based detector.
  3. Add a log alert.
  4. Select a connection.

    For a Unified Identity connection, select Splunk Data Platform.

    For service accounts, select the appropriate connection.

  5. Enter an SPL search, then run the search.
  6. Review the matching events, discovered fields, and field summary.
  7. Configure a count condition using equal to, less than, or greater than.
  8. Configure when the alert clears and how long to suppress subsequent firings.
  9. Set the search schedule and lookback period.
    The minimum schedule interval is 5 minutes.
  10. Enter an alert message.
    You can reference selected log fields in the message.
  11. Select the criticality and notification destinations.
  12. Review the connection, search, schedule, lookback, conditions, message, owner, and search runner, then save the detector.

The detector appears in the detector list and begins evaluating the SPL search on its configured schedule.