search

alertmanager / alert_manager

Splunk Alert Manager with advanced reporting on alerts, workflows (modify assignee, status, severity) and auto-resolve features
Other
82 stars 44 forks source link

AlertManager 2.2.0 - incident numbers are 0 #270

Open paki20 opened 4 years ago

paki20 commented 4 years ago

Hi,

I have a same issue : https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-get-alerts-in-alertmanager-to-show-as-incidents/td-p/355342

Just can't work out why all the incident numbers are 0, even with the time range set to way back.

I have Splunk 7.3.4 and I installed AlertManager 2.2.0 on my search head (it's splunk POC).

Could you help me, please?

Thanks.

Pcktech commented 4 years ago

Did you use a custom index (not main, not alerts)? If so, then I recently had this exact problem. You need to create a $SPLUNK_HOME/etc/apps/alert_manager/local/macros.conf file. Copy paste the alert_manager index macro from the /default/macros.conf file to the /local/macros.conf file, and modify it to whatever you'd like, but making sure index=custom-name is there. Then magically (no reboot needed) your data appears.

The UI configuration setup page didn't seem to set this automatically.