Log events
Construct custom log events to index and search metadata. Log events are sent to your Splunk deployment for indexing. As with other alert actions, log events can be used alone or in addition to other alert actions for a given alert.
Authorization requirement
Using the log event alert action requires the edit_tcp capability for users without the admin role.
Tokens for log events
When you set up a log event alert action, populate event fields with plain text or tokens representing search, job, or server metadata. You can also use tokens to access the first search results set.
Tokens available for email notifications are also available for log events. For more information on using tokens with alert actions, see Use tokens in email notifications in this manual.
Set up a log event alert action
Here are the steps for setting up a custom log event alert action after building a search.
Prerequisites
To review token usage, see Use tokens in email notifications in this manual.
Steps
- You can configure the log event action when ceating a new alert or editing an existing alert's actions. Follow one of the options below.
Option Steps Create a new alert From the Search page in the Search and Reporting app, select Save As > Alert. Enter alert details and configure triggering and throttling as needed. Edit an existing alert From the Alerts page in the Search and Reporting app, select Edit>Edit actions for an existing alert.
- From the Add Actions menu, select Log event.
- Add the following event information to configure the alert action. Use plain text or tokens for search, job, or server metadata.
- Event text
- Source and sourcetype
- Host
- Destination index for the log event. The
mainindex is the default destination. You can specify a different existing index.
In a distributed environment, make sure youroutputs.conffile is configured correctly, for example:[tcpout] defaultGroup = your_target_indexer indexAndForward = false and [indexAndForward] index=false
You must also define the destination index on both the search head and the indexers. For more information on configuring forwarding in
outputs.conf, see Configure forwarding with outputs.conf in the Splunk Universal Forwarder Manual. - Click Save.
The following steps are the same for saving new alerts or editing existing alerts.
| Output results to a CSV lookup | Monitor triggered alerts |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Download manual
Feedback submitted, thanks!