Class: Splunk::Pickaxe::Alerts

Inherits:
Objects
  • Object
show all
Defined in:
lib/splunk/pickaxe/objects/alerts.rb

Instance Attribute Summary

Attributes inherited from Objects

#environment, #pickaxe_config, #service

Instance Method Summary collapse

Methods inherited from Objects

#config, #create, #entity_file_extensions, #entity_file_name, #find, #initialize, #needs_update?, #save, #save_config, #skip?, #sync, #update

Constructor Details

This class inherits a constructor from Splunk::Pickaxe::Objects

Instance Method Details

#alert_defaults ⇒ Object 



42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/splunk/pickaxe/objects/alerts.rb', line 42

def alert_defaults
  {
    # Who to email
    'action.email.to' => pickaxe_config.emails.join(','),

    # How often to run alert (every hour)
    'cron_schedule' => '0 * * * *',
    'is_scheduled' => '1',

    # Email subject
    'action.email.subject' => 'Splunk Alert: $name$',
    'action.email.subject.alert' => 'Splunk Alert: $name$',

    # Email result formatting (inline results, table format, include alert link)
    'action.email.format' => 'table',
    'action.email.inline' => '1',
    'action.email.include.view_link' => '1',

    # Is an email alert
    'actions' => 'email',
    'action.email.sendresults' => '1',

    # Alert severity (High)
    'alert.severity' => '4',

    # When to trigger alert
    'alert_type' => 'number of events',
    'alert_comparator' => 'greater than',
    'alert_threshold' => '0',

    # The time bounds for alert search
    'dispatch.earliest_time' => '-1h',
    'dispatch.latest_time' => 'now',

    # Track alerts
    'alert.track' => '1',

    # Don't supress any alerts
    'alert.suppress' => '0'
  }
end

#entity_dir ⇒ Object 



16
17
18
 
# File 'lib/splunk/pickaxe/objects/alerts.rb', line 16

def entity_dir
  DIR
end

#entity_file_path(splunk_entity) ⇒ Object 



20
21
22
23
24
25
 
# File 'lib/splunk/pickaxe/objects/alerts.rb', line 20

def entity_file_path(splunk_entity)
  File.join(
    pickaxe_config.execution_path, entity_dir,
    entity_file_name(splunk_entity)
  )
end

#name(entity) ⇒ Object 



27
28
29
30
 
# File 'lib/splunk/pickaxe/objects/alerts.rb', line 27

def name(entity)
  # The alert name contains the environment name
  "#{entity['name']} [#{environment.capitalize}]"
end

#splunk_config(entity_yaml) ⇒ Object 



32
33
34
35
36
37
38
39
40
 
# File 'lib/splunk/pickaxe/objects/alerts.rb', line 32

def splunk_config(entity_yaml)
  # Include default values
  config = alert_defaults

  # Override defaults with any config provided in yaml
  config.merge! entity_yaml['config']

  config
end

#splunk_entity_keys ⇒ Object 



84
85
86
 
# File 'lib/splunk/pickaxe/objects/alerts.rb', line 84

def splunk_entity_keys
  Splunk::Pickaxe::ALERT_KEYS
end

#splunk_resource ⇒ Object 



12
13
14
 
# File 'lib/splunk/pickaxe/objects/alerts.rb', line 12

def splunk_resource
  %w[saved searches]
end