You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
56 lines
1.9 KiB
56 lines
1.9 KiB
# This file contains possible attributes and values for summarizing KPI
|
|
# searches into the ITSI summary index.
|
|
#
|
|
# There is an alert_actions.conf in $SPLUNK_HOME/etc/apps/itsi/default/.
|
|
# To set custom configurations, place an alert_actions.conf in
|
|
# $SPLUNK_HOME/etc/apps/itsi/local/. You must restart Splunk to enable
|
|
# configurations.
|
|
#
|
|
# To learn more about configuration files (including precedence) please see
|
|
# the documentation located at
|
|
# http://docs.splunk.com/Documentation/ITSI/latest/Configure/ListofITSIconfigurationfiles
|
|
|
|
####
|
|
# GLOBAL SETTINGS
|
|
####
|
|
# Use the [default] stanza to define any global settings.
|
|
# * You can also define global settings outside of any stanza, at the top
|
|
# of the file.
|
|
# * Each .conf file should have at most one default stanza. If there are
|
|
# multiple default stanzas, attributes are combined. In the case of
|
|
# multiple definitions of the same attribute, the last definition in the
|
|
# file wins.
|
|
# * If an attribute is defined at both the global level and in a specific
|
|
# stanza, the value in the specific stanza takes precedence.
|
|
|
|
[indicator]
|
|
_name = <string>
|
|
* The name of the summary index where Splunk will write the events.
|
|
* Default: itsi_summary
|
|
|
|
inline = [1|0]
|
|
* Specifies whether the summary index search command will run as part
|
|
of the scheduled search or as a follow-on action. This is useful
|
|
when the results of the scheduled search are expected to be large.
|
|
* Default: 1 (true)
|
|
|
|
ttl = <integer> [p]
|
|
* The minimum time to live (TTL), in seconds, of the search artifacts
|
|
if this action is triggered.
|
|
* If p follows the integer, then the integer is the number of scheduled periods.
|
|
* Default: 120 (2 minutes)
|
|
|
|
####
|
|
# Per Splunk Enterprise implementation of summary index alert action in alert_actions.conf
|
|
####
|
|
|
|
_itsi_kpi_id = <string>
|
|
* The KPI ID.
|
|
* Required.
|
|
* There is no default.
|
|
|
|
_itsi_service_id = <string>
|
|
* The service ID.
|
|
* Required.
|
|
* There is no default.
|