Implementing Splunk 7(Third Edition)
上QQ阅读APP看书,第一时间看更新

Sharing

Should the alert Permissions-Private or Shared in App be shared with other users?

For our example, I've elected to trigger an email to mary (marys@splunker.com), with a link to both the alert and the alert results within the email so that she can review her errors. In addition (as shown in the next screenshot), I have decided to send an email Once (for all events/errors within the time range, not for each one) and leave the alert as Private:

After hitting Save, our alert is ready to go: