View alert details
The alert details page brings together alert metadata, signal behavior, troubleshooting guidance, root cause analysis, and supporting evidence.
The alert details page provides a central place to investigate an alert after it fires. It brings together alert metadata, metric behavior, troubleshooting guidance, root cause analysis, and supporting evidence so that you can understand what happened and decide what to do next.
This page displays the details of an alert. It organizes the details into three main tabs:
-
Overview : summarizes the alert and its signal behavior.
-
Root cause analysis : helps identify likely causes and contributing entities. This tab applies only to AI-enhanced rules.
-
Evidence : provides the telemetry and contextual data used to support the investigation. This tab applies only to AI-enhanced rules.
Overview tab
The Overview tab helps you understand the alert state, why it triggered, and where to continue your investigation. Use it as the starting point for triage.
Alert summary
The page displays the alert name, severity, status, detector or rule information, trigger time, and other key metadata. You can identify the alert and understand its current state.
Root cause
The Root cause section on the Overview tab provides an immediate explanation of why the alert likely fired.
The Root cause section is available only for the alerts that are in scope for AI-driven root cause analysis.
The section displays the system-generated root cause insight for the selected alert. You can identify the most likely contributing component, entity, or condition.
This insight helps reduce manual investigation time and directs your attention to the part of the system most likely responsible for the alert.
Validate the suspected root cause by using the signal chart, troubleshooting tools, the Root cause analysis tab, and the Evidence tab before you confirm remediation actions.
Select Review root cause to open the Root cause analysis tab for a detailed analysis.
Signal chart
The signal chart is a key part of the Overview tab. It displays the metric trend over a selected time range, with alert markers and a detailed view around the trigger.
Use the chart to compare the current value with historical behavior and threshold boundaries.
The time dropdown in the chart section controls the time window displayed in the chart. You can switch the signal view to a different period, such as a recent short interval for active troubleshooting or a longer range for historical comparison.
Troubleshooting tools
The troubleshooting tools section provides supporting information for your next investigation steps. Depending on the alert configuration and available telemetry, this section can include links to the detector, configured tips, related content, dashboards, and dimension-based data.
Other actions
You can perform one of the following actions:
| Action | Description |
|---|---|
| Mute | Provides a control to mute the alert. |
| Resolve alert | Mark the alert resolved after investigation. The active-alert list also provides alert actions. |
Root cause analysis
The Root cause analysis tab is available only for the alerts that are in scope for AI-driven root cause analysis.
The Root cause analysis tab helps you analyze the root cause of an issue. It groups possible causes, impacted entities, and relevant correlations so the team can focus on the most likely source of the problem.
-
Analysis can take several minutes and continues if you leave the page. You can access the results when you return. A regenerate option might be available for supported investigations.
-
The root cause is an investigation result, not a guarantee. Compare its explanation and evidence with the signal chart and other telemetry before choosing an action.
The AI troubleshooting agent analyzes supported alerts and presents suspected root causes with supporting context. You can select a suspected cause to investigate it further. The agent provides a relative confidence level based on the amount of supporting evidence and links to relevant Observability Cloud components. The page displays investigation progress while the analysis runs, and you can provide thumbs-up or thumbs-down feedback when that control is available. For more information about root cause analysis, see AI troubleshooting agent and remediation plan in Splunk Observability Cloud.
AI troubleshooting insights and action plans provide recommendations based on available telemetry. Always review and validate all AI-suggested steps before executing operational changes in your environment.
Evidence
The Evidence tab is available only for the alerts that are in scope for AI-driven root cause analysis.
The Evidence tab contains the supporting telemetry used to investigate and validate the alert. You can review the signals and records associated with the alert and verify what happened during the alert window.
The Evidence tab brings together the underlying data that supports the alert investigation. Instead of relying only on the alert message, you can inspect the evidence collected around the same time period, compare related telemetry, and confirm whether the suspected root cause occurred. This gives you a path from the suspected cause to the underlying data used to evaluate it.