Alerts For Splunk Admins

The overall idea behind this application is to provide a variety of alerts that detect issues or potential issues within the Splunk log files and then advise via an alert that this has occurred. This application was built as there were a variety of messages in the Splunk console and logs in Splunk that if acted upon could have prevented an issue within the environment. In addition to the alerts there are a few dashboards that relate to troubleshooting indexer/heavy forwarder performance issues. Many of the alerts are informational and the description and comments inside the alert explain which alerts are likely to generate the most noise. All alerts are disabled by default so you can choose which alerts may be appropriate for your environment. Feedback is welcome!