Repository navigation
Installation Guide
This topic describes the techniques used by the Alert Manager and how to install it.
- All indexers and search heads require Splunk Enterprise version 6.2 or later.
- All Splunk universal forwarders require Splunk Enterprise version 6.2 or later.
The Alert Manager works as a generic scripted alert action in Splunk, callert alert_handler.py. When an alert fires, the alert_handler.py script catches all the parameters and job details from the alert search and writes aggregated data to an index and a state to a collection in Splunk's App Key Value Store.
There are differents events written by the alert manager. All of them are stored in a configurable index.
- One metadata event per new incident with sourcetype alert_metadata (up to 5 kilobytes per incident)
- One event per each change on an incident (change owner, priority or status) with sourcetype incident_change (less than 1 kilobyte per change)
The total amout of data generated by the Alert Manager depends on number of fired alerts. All data is written to Splunk through the API and counts towards the license.
By default, the Alert Manager creates and uses an index named alerts. The index used by the App can be changed during the installation process.
As described above, the App writes different data and uses the Splunk framework components to provide the end-user functionality.
-
App Key Value Store
- Used to save and track states of incidents
- Used to store incident default and user settings
-
Splunk REST API
- Write events to the index
- Add/retrieve data from the App Key Value Store
- Manage app configuration
-
Splunk JS Stack
- Extend Splunk dashboards with workflow functionalities
- Extend and enhance Splunk visualization components (Single value, Tables, ...)
- Provide 3rd party visualizations
--> decide which index to be used
--> Use app setup or alert_manager.conf