Alerts

The fields and tags in the Alerts data model describe the alerts produced by alerting systems, such as Nagios or NetCool, for use in Splunk correlation searches or dashboards. They are not to be used to describe Splunk Alerts or Notable Events, which are already modeled in other contexts.

Tags used with the Alert Messages event category

Object name(s)	Tag name	Required?
Alerts	alert	YES

Fields for the Alert Messages event category

Object name(s)	Field name	Data type	Description	Expected values
Alerts	app	string	The application involved in the event, such as win:app:trendmicro, vmware, nagios.
Alerts	dest	string	The destination where the alert message was sent to, such as an email address or SNMP trap. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name.
Alerts	body	string	The body of a message.
Alerts	id	string	The unique identifier of a message.
Alerts	severity	string	The severity of a message. Note: This field is a string. Please use a severity_id field for severity ID fields that are integer data types. Specific values are required. Please use vendor_severity for the vendor's own human-readable strings (such as Good, Bad, Really Bad, and so on).	critical, high, medium, low, informational, unknown
Alerts	severity_id	string	A numeric severity indicator for a message.
Alerts	src	string	The source of the message. May be aliased from more specific fields, such as src_host, src_ip, or src_name. Also see the optional src_* fields listed in Optional Subject Fields.
Alerts	subject	string	The message subject.	free-form
Alerts	type	string	The message type.	alarm, alert, event, task, unknown