Log events

Construct custom log events to index and search metadata. Log events are sent to your Splunk deployment for indexing. As with other alert actions, log events can be used alone or in addition to other alert actions for a given alert.

Authorization requirement

Using the log event alert action requires the edit_log_alert_event capability.

Tokens for log events

When you set up a log event alert action, populate event fields with plain text or tokens representing search, job, or server metadata. You can also use tokens to access the first search results set.

Tokens available for email notifications are also available for log events. For more information on using tokens with alert actions, see Use tokens in email notifications in this manual.

Set up a log event alert action

Here are the steps for setting up a custom log event alert action after building a search.

Prerequisites
To review token usage, see Use tokens in email notifications in this manual.

Steps

1. You can configure the log event action when ceating a new alert or editing an existing alert's actions. Follow one of the options below.
   

   Option	Steps
   Create a new alert	From the Search page in the Search and Reporting app, select Save As > Alert. Enter alert details and configure triggering and throttling as needed.
   Edit an existing alert	From the Alerts page in the Search and Reporting app, select Edit>Edit actions for an existing alert.

The following steps are the same for saving new alerts or editing existing alerts.

2. From the Add Actions menu, select Log event.
3. Add the following event information to configure the alert action. Use plain text or tokens for search, job, or server metadata.
   
   • Event text
   • Source and sourcetype
   • Host
   • Destination index for the log event. The main index is the default destination. You can specify a different existing index.
   
   In a distributed environment, make sure your outputs.conf file is configured correctly, for example:

   [tcpout]
   defaultGroup = your_target_indexer
   indexAndForward = false
   and
   [indexAndForward]
   index=false 
   

   You must also define the destination index on both the search head and the indexers. For more information on configuring forwarding in outputs.conf, see Configure the universal forwarder using configuration files in the Splunk Universal Forwarder Manual.

4. Click Save.