System insights alerts

How to set an alert for system insights

Create system insights alerts to take specific action under specific circumstances. For example, you might want to be alerted if a specific playbook has failed to run.

Use the Splunk alerts system to create system insights. This article describes one example for an alert you might create.

To create a system insights alert, follow these steps:

  1. Within any panel in the System Insights dashboard, select the magnifying glass icon ( magnifying glass icon ) to view the query information for that panel in the Splunk Search app.

  2. The search query for the corresponding dashboard panel appears in the Search field. Use that query as is or modify it for a more specific search.

    For example, you might want to use the existing search for the All failures dashboard panel, so you are notified whenever a playbook fails.

    Alternatively, modify the existing search query or enter a new search query for a different alert, for example, if a specific playbook has a failed run. For this new example, enter following query, using the phantom_system_insights table:

    CODE 
    index=phantom_system_insights hostname=<your hostname> | search system_insights_object_type=playbook_run status=failed pb_run_playbook_id=<your playbook id>

  3. From the Save As menu, select Alert.

  4. In the Save As Alert window, at a minimum, specify the following:

    • Title: Specify the title that will appear in the Alerts page
    • Trigger actions: Specify what you want to happen when this search produces results. For example, you might choose to send an email or run a script.

  5. Optionally specify additional settings, like alert type and trigger conditions.

  6. Select Save, then optionally view the alert.

  7. Select the Alerts menu to view and edit your alerts.

Example: Automation Broker alert

Create an alert to let you know if your Splunk Automation Brokers has failed.

To create this alert, follow these steps:

  1. In Splunk SOAR, copy the name of the Automation Broker you want to create the alert for. Within Splunk SOAR, navigate to Administration > Product Settings > Automation Broker.

  2. Within your Splunk deployment, open Search. Under Apps, select Search & Reporting.

    Alternatively, from within the System Insights dashboard, select the Actions tab, then select the search magnifying glass icon in the Action History table. When the search window appears, clear its contents.

  3. In the search window, enter the following query:

    CODE 
    index=phantom_system_insights app_run_automation_broker_name=<AB_NAME> system_insights_object_type=app_run status=failed

  4. Select Save As, then Alert.

  5. In the alert configuration, set a title and alert conditions. For example, you might choose run a search query each hour to see if actions have failed for the internal Automation Broker in the last hour and, if they did, send an email. For additional details on configuring an alert, refer to the main section of this article.

See also

For details on Splunk alerts, see Getting started with alerts for Splunk.

For details on Splunk search, see Get started with Search.