You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 2, 2025. It is now read-only.
Copy file name to clipboardExpand all lines: alerts-detectors-notifications/alerts-and-detectors/create-detectors-for-alerts.rst
+41-19Lines changed: 41 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ Create detectors
22
22
23
23
The high-level steps for creating a detector are:
24
24
25
-
1. Choose:ref:`how to create the detector <how-to-create-detector>`.
25
+
1. Decide:ref:`how you want to create the detector <how-to-create-detector>`.
26
26
27
27
2. Create :ref:`alert rules <build-rules>` to the detector to specify when to trigger alerts.
28
28
@@ -35,8 +35,7 @@ There are several ways to create a detector.
35
35
36
36
* You can clone an existing detector if you have existing detectors that you want to modify. See :ref:`clone-detector`.
37
37
* You can customize AutoDetect detectors. See :ref:`autodetect-customize`.
38
-
* Start from the Detector tab to create detectors based on what you are currently viewing, such as a chart or the Infrastructure Navigator. See :ref:`create-detector-from-chart`.
39
-
* Create a detector from a dashboard chart to preselect one of the chart signals as the signal to be monitored. See :ref:`create-detector-from-chart`.
38
+
* Create a detector from one of the signals on the chart you're viewing. See :ref:`create-detector-from-chart`.
40
39
* Create a detector from scratch. See :ref:`create-detector-from-scratch`.
41
40
* Use the API to programmatically create detectors, instead of creating them through the user interface. See :ref:`create-via-api`.
42
41
@@ -45,7 +44,7 @@ There are several ways to create a detector.
To create a new detector for Infrastructure or Custom Metrics from scratch, you can either select :guilabel:`New Detector` under :guilabel:`Detectors &SLOs`, or select :menuselection:`Custom Detector` from the create menu on the navigation bar. Enter a detector name and then select :guilabel:`Create Alert Rule` to proceed to the alert rule builder. For instructions on building the rule, see :ref:`build-rules`.
75
+
To create a new detector from scratch, you can either select :guilabel:`Create detector` on the :guilabel:`Detectors &SLOs` page, or select :menuselection:`Detector` from the create menu on the navigation bar. Enter a detector name and then select :guilabel:`Create alert rule` to proceed to the alert rule builder. For instructions on building the rule, see :ref:`build-rules`.
77
76
78
77
.. _create-via-api:
79
78
@@ -86,8 +85,7 @@ Using the API to create a detector provides a number of capabilities that are no
86
85
87
86
- For information on using the UI to edit detectors created using the API, see :ref:`v2-detector-signalflow`.
88
87
89
-
.. note:: If a detector display includes a SignalFlow tab, you are viewing a detector created programmatically using the :new-page:`Splunk Observability Cloud Detectors API <https://dev.splunk.com/observability/reference/api/detectors/latest>`. If you are familiar with that API, you can use the detector display to
90
-
view and edit the detector code and make changes to the detector rules.
88
+
.. note:: If a detector display includes a :guilabel:`SignalFlow` tab, you are viewing a detector created programmatically using the :new-page:`Splunk Observability Cloud detectors API <https://dev.splunk.com/observability/reference/api/detectors/latest>`. If you are familiar with that API, you can use the detector display to view and edit the detector code and make changes to the detector rules.
91
89
92
90
93
91
.. _build-rules:
@@ -140,7 +138,7 @@ If the detector has multiple signals, select what signal you want to alert on.
On the :strong:`Alert condition` tab, select the type of condition that triggers an alert. If you want to create compound conditions using AND or OR operators on the Alert settings tab, you must use the Custom Threshold condition. This applies whether you are monitoring a single signal or multiple signals.
141
+
On the :strong:`Alert condition` tab, select the type of condition that triggers an alert. If you want to create compound conditions using ``AND`` or ``OR`` operators on the :guilabel:`Alert settings` tab, you must use the Custom Threshold condition. This applies whether you are monitoring a single signal or multiple signals.
144
142
145
143
See :ref:`condition-reference` for the list of the available built-in alert conditions for Infrastructure Monitoring and Custom Metrics detectors.
146
144
@@ -161,7 +159,7 @@ In the chart, use a preview of the alerts that are triggered based on the settin
161
159
162
160
After you have specified settings for triggering alerts, continue to the next tab to create a message that is sent when the alert is triggered.
163
161
164
-
.. note:: If you don't see the Alert settings tab, you are viewing a detector that was created using the API; alert settings are defined in the :ref:`SignalFlow tab<v2-detector-signalflow>`.
162
+
.. note:: If you don't see the :guilabel:`Alert settings` tab, you are viewing a detector that was created using the API; alert settings are defined in the :ref:`SignalFlow tab<v2-detector-signalflow>`.
165
163
166
164
.. _alert-message:
167
165
@@ -267,9 +265,9 @@ The following table explains different types of email notifications:
On the :strong:`Activate` tab you see a summary of the detector settings you specified. Review the summary and make any necessary changes in the associated tabs, then name the rule; by default, the rule name is the same as the detector name. The rule name is displayed on the Alerts page and in notifications.
268
+
On the :guilabel:`Activate` tab you see a summary of the detector settings you specified. Review the summary and make any necessary changes in the associated tabs, then name the rule. By default, the rule name is the same as the detector name. The rule name is displayed on the :guilabel:`Alerts` page and in notifications.
271
269
272
-
Select :guilabel:`Activate Alert Rule` to save the detector and begin monitoring the specified signal. After you activate the detector, the :strong:`Alert Rules` tab of the detector is displayed, showing the signal you selected and a summary of the rule you built. You can edit the detector name; the text you enter here is displayed as the detector name on the :guilabel:`Detectors` tab under :guilabel:`Detectors &SLOs`. You can also provide additional descriptive text below the name, for example, to clarify the purpose of the detector for others.
270
+
Select :guilabel:`Activate Alert Rule` to save the detector and begin monitoring the specified signal. After you activate the detector, the :guilabel:`Alert Rules` tab of the detector is displayed, showing the signal you selected and a summary of the rule you built. You can edit the detector name; the text you enter here is displayed as the detector name on the :guilabel:`Detectors` tab under :guilabel:`Detectors &SLOs`. You can also provide additional descriptive text to clarify the purpose of the detector for others.
273
271
274
272
275
273
.. note:: If you make any changes to the detector name or description, select the :guilabel:`Save` button. If you select the :strong:`Close` button without saving, your changes will be lost.
@@ -283,9 +281,9 @@ Select :guilabel:`Activate Alert Rule` to save the detector and begin monitoring
.. note:: This section assumes you are familiar with the :new-page:`Splunk Observability Cloud Detectors API <https://dev.splunk.com/observability/reference/api/detectors/latest>`.
284
+
.. note:: This section assumes you are familiar with the :new-page:`Splunk Observability Cloud detectors API <https://dev.splunk.com/observability/reference/api/detectors/latest>`.
287
285
288
-
If you are modifying a detector that was created using the API, you can add and edit detector rules using the SignalFlow tab. The SignalFlow program text replaces the Alert signal, Alert condition, and Alert settings tabs that are used when creating and editing detectors using the UI.
286
+
If you are modifying a detector that was created using the API, you can add and edit detector rules using the :guilabel:`SignalFlow` tab. The SignalFlow program text replaces the :guilabel:`Alert signal`, :guilabel:`Alert condition`, and :guilabel:`Alert settings` tabs that are used when creating and editing detectors using the UI.
289
287
290
288
Every ``publish`` statement in a SignalFlow ``detect`` statement corresponds to a rule on the Alert Rules tab. The label you enter inside the ``publish`` block is displayed next to the number of active alerts displayed on the Alert Rules tab.
291
289
@@ -346,8 +344,8 @@ On the :guilabel:`Alert Rules` tab of a detector, you can use the actions menu (
346
344
347
345
.. _disable-enable-rules:
348
346
349
-
Activate/deactivate alert rules
350
-
---------------------------------
347
+
Activate or deactivate alert rules
348
+
-------------------------------------
351
349
352
350
If a detector has multiple rules, such as different rules for different severity levels, you can specify which ones to activate or deactivate. Deactivating a rule prevents it from generating any events or sending any notifications. Use this option to decrease or increase the number of alerts the detector is triggering.
353
351
@@ -367,10 +365,34 @@ Delete alert rules
367
365
368
366
Use this option to remove a rule from the detector.
Use tags to indicate the state of a detector, its data source, or any other property you want to label. For example, you can tag a detector with ``prod`` to indicate that it monitors a production environment.
374
+
375
+
You can tag detectors from the list view. To see a list of detectors and add tags, do the following:
376
+
377
+
#. To open the list view, open the :guilabel:`Detectors &SLOs` page, then select the :guilabel:`Detectors` tab.
378
+
#. Select the actions menu (|more|) for the detector you want to assign tags to.
379
+
#. Select :guilabel:`Edit tags`.
380
+
#. Enter tags for the detector. You can add no more than 20 tags per detector.
Link teams to a detector to indicate which team is responsible for the maintenance and monitoring of the detector. Teams associated with a detector can see the detector and its active alerts on the team's landing page.
387
+
388
+
To link teams to a detector, select the detector actions menu (|more|), either from the list view of the individual detector view, then select :guilabel:`Link to teams`. You can link no more than 20 teams to a detector.
389
+
390
+
.. note:: The list of teams linked to a detector is independent of notification settings. Associated teams don't automatically get notified of new alerts. To configure notifications, see :ref:`manage-notifications`.
To protect detectors from being edited or deleted by other members of your organization, you can specify which users and teams have permissions for them.
376
-
For more information, see :ref:`detector-manage-permissions`.
397
+
To protect detectors from being edited or deleted by other members of your organization, you can specify which users and teams have permissions for them. For more information, see :ref:`detector-manage-permissions`.
Copy file name to clipboardExpand all lines: alerts-detectors-notifications/alerts-and-detectors/detector-options.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ Detector options
9
9
.. meta::
10
10
:description: How to set detector options in the Options tab.
11
11
12
-
The Options tab lets you specify some of the same settings that are available in the :ref:`Chart Options tab<chart-options-tab>` of a chart.
12
+
The :guilabel:`Options` tab lets you specify some of the same settings that are available in the :ref:`Chart Options tab<chart-options-tab>` of a chart.
0 commit comments