Alerting is the act of getting a notification, let's say an SMS, email, or otherwise, to raise awareness to an outage or potential issue. Alerting itself has become more and more important within companies, and the alerting tools that are in place can be very expensive, expensive to scale, and very exclusive to specific systems. They also often don't offer as much intelligence within the alert, and they may not be as customizable as a tool like Splunk to the needs of a company. Every organization wants an alerting system that sends only actionable alerts and eliminates noisy alerts. Splunk can be good for consolidating multiple alerting tools, as well as reducing alert noise.

Alerting in Splunk is much more complex than just saving a search query. Where the action may be that easy, it is also a matter of understanding the fine details to explain what the alert is doing once you receive an actionable alert that makes the alert successful or not.

In this chapter we will learn...