Enable and configure platform alerts

Platform alerts are saved searches included in the monitoring console. Platform alerts notify Splunk Enterprise administrators of conditions that might compromise their deployment environment. When an alert is triggered, the Monitoring Console Overview page displays a notification. You can also view the alert and its results by going to Overview > Alerts > Managed triggered alerts.

The included platform alerts get their data from REST endpoints. Platform alerts are disabled by default.

Enable platform alerts

Prerequisite

Configure your Monitoring Console. See Single instance Monitoring Console setup steps or Multi-instance Monitoring Console setup steps depending on your deployment type.

1. From the monitoring console Overview, click Triggered Alerts > Enable or Disable.
2. Click the Enabled check box next to the alerts that you want to enable.

You can also set an alert action, such as an email notification.

Configure platform alerts and set alert actions

You can view and configure the default settings and parameters for platform alerts, including the following:

• Alert thresholds, if applicable
• Alert schedule
• Suppression time
• Alert actions (such as sending an email or starting a custom script)

To change an alert threshold, perform the following steps:

1. From the Monitoring Console, click Overview > Alerts > Enable or Disable.
2. Find the alert you want to configure and click Edit.
3. Edit the threshold field to your desired value.
4. Click Save.

To view and edit advanced settings like alert schedule, trigger conditions, and alert actions, perform the following steps:

1. From the Monitoring Console, click Overview > Alerts > Enable or Disable.
2. Find the alert you want to configure and click Advanced edit.
3. Modify the settings, if desired.
4. Click Save.

If you enable email notifications, make sure that you have defined a valid mail host in Settings > Server settings > Email settings.

For guidance on alert actions, see Set up alert actions in the Alerting Manual.

You can also view the complete list of default parameters for platform alerts in $SPLUNK_HOME/etc/apps/splunk_monitoring_console/default/savedsearches.conf. If you choose to edit configuration files directly, put the new configurations in a local directory instead of the default.

Never edit configuration files in the default directory.

Default platform alerts in the monitoring console

The following platform alerts are available by default in the monitoring console. To monitor your deployment with platform alerts, enable the individual alerts that you want.

Alert name	Description	For more information
Abnormal State of Indexer Processor	Fires when one or more of your indexers reports an abnormal state. This abnormal state can be either throttled or stopped.	For details on which indexer is in which abnormal state, and to begin investigating causes, see the monitoring console Indexing Performance: Deployment dashboard's Indexing Performance by Instance panel. For information about the dashboard, see Indexing performance dashboards in this manual.
Critical System Physical Memory Usage	Fires when one or more instances exceeds 90% memory usage (by any process, Splunk software or otherwise). On most Linux distributions, this alert can trigger if the OS is engaged in buffers and filesystem caching activities. The OS releases this memory if other processes need it, so it does not always indicate a serious problem.	For details on instance memory usage, navigate to the monitoring console Resource Usage: Deployment dashboard. For information about the dashboard, see Resource usage dashboards in this manual.
Expired and Soon To Expire Licenses	Fires when you have licenses that have expired or will expire within two weeks.	For information about your licenses and license usage, click Licensing in the monitoring console.
Missing forwarders	Fires when one or more forwarders are missing.	See the forwarders dashboards in the monitoring console.
Near Critical Disk Usage	Fires when you have used 80% of your disk capacity.	For more information about your disk usage, navigate to the three monitoring console Resource Usage dashboards and read Resource usage dashboards in this manual.
Saturated Event-Processing Queues	Fires when one or more of your indexer queues reports a fill percentage, averaged over the last 15 minutes, of 90% or more. This alert can inform you of potential indexing latency.	For more details about your indexer queues, navigate to the two monitoring console Indexing Performance dashboards and read Indexing performance dashboards in this manual.
Search Peer Not Responding	Fires when any of your search peers (indexers) is unreachable.	For the status of all your instances, see the monitoring console Instances view.
Total License Usage Near Daily Quota	Fires when you have used 90% of your total daily license quota.	For more information about your license usage, click Licensing in the monitoring console.

Longevity of platform alert search artifacts

In savedsearches.conf, the dispatch.ttl setting dictates that the searches from platform alerts keep search artifacts for four hours. But if an alert is triggered, its search artifact stays for seven days. This means that the link sent in an email to inspect the search results of a triggered alert expires in seven days (by default).

Next step

To set up health checks, see Access and customize health check. This step is optional.