KB 181: Initializing new alerting framework searches in Splunk App 7.3.0

Description

The Splunk app release 7.3.0 contains several new panel integrations for the alerting framework. However, it was noted during testing that the app is not correctly initializing these new searches, and no bell icon is shown below the panel to indicate that a search can be created from the panel. The new panel integrations in each dashboard are:

• tRFC Monitor (SM58)

  • Count by Function Module

• Transports Overview

  • Segregation of Duty (SOD) Violations

• qRFC Monitor

  • qRFC Failures Count Timeline

• Java Systems Overview

  • System Problems

  • CPU Utilization

  • Memory Utilization

  • GC Problems

Cause

The alerting framework backend is built on two data stores:

• A CSV file shipped with the app containing information on all panel integrations for that release, and

• A KV store that each Splunk installation uses to operate the alerting framework

For each release, the CSV is supposed to update the KV store with new data. However, this is not occurring.

Resolution

For 7.3.0, users can update the alerting framework in their installation by running the following search:

| inputlookup pc_panel_wise_alert
| eval key=_key
| table key alert_title interested query
| search key IN ("trfc_errors__Count-by-Function-Module",
                 "sap_transport_dashboard__Segregation-of-Duty-SOD-Violations",
                 "qrfc_monitor__qRFC-Failures-Count-Timeline",
                 "java_system_overview__System-Problems",
                 "java_system_overview__CPU-Utilization",
                 "java_system_overview__Memory-Utilization",
                 "java_system_overview__GC-Problems")
| join type=left key
    [ inputlookup panel_wise_alert_default.csv
    | table key "Current Interested"
    | rename "Current Interested" as interested]
| outputlookup pc_panel_wise_alert key_field=key

Once completed, you can load these pages and test if the corresponding panels show the bell icon in their toolbar when you hover your cursor over the panel.

[Product version]

[SAP product version]