Splunk Operational Intelligence Cookbook - Third Edition

Generating alert events for high sensor readings

In this final recipe, you will create an alert type that triggers when temperature sensors in your metrics data exceed allowable levels. However, rather than fire off an email each time the alert fires, the alert will generate an event that is indexed by Splunk and searchable. This type of information could be useful in a situation where you wish to summarize verbose sensor data down to only specific notable events of interest. This notable event data could then be used for further visualization or analytics. For example, a single high temperature sensor event might be of less interest than a pattern of high temperature alerts over time, which could be an indicator of something more serious. ...