Managing an environment (machines and/or generated data) requires a continuous check of the established acceptable conditions or for the occurrence of certain events. It is one thing to leverage the power and flexibility of Splunk for searching and visualization, but once you've created searches and reports, it is unrealistic (and boring!) to expect anyone to run and rerun your searches over and over again, all the time.

As we covered earlier in this book, Splunk searches can be real time or historical. Both can be configured to send alerts based on an extensive set of threshold and trend-based scenarios (many real-life examples are listed on the Splunk website).

Generally speaking, Splunk enables you to design three broad types of alerts, as follows: