Splunk REST API -指定警报的相对时间范围

import requests
import json

# 配置Splunk连接信息
url = "https://your-splunk-host:8089/servicesNS/nobody/system/alerts"
username = "your-username"
password = "your-password"

# 定义警报配置
alert_config = {
    "name": "Example Alert",
    "description": "This is an example alert",
    "search": "index=main | stats count by host",
    "condition": {
        "type": "greaterThan",
        "value": 100,
        "field": "count"
    },
    "time_range": "last 5m",
    "actions": [
        {
            "name": "Email",
            "arguments": {
                "to": "admin@example.com",
                "subject": "Splunk Alert"
            }
        }
    ]
}

# 发送请求
headers = {
    "Content-Type": "application/json"
}
response = requests.post(url, auth=(username, password), headers=headers, data=json.dumps(alert_config))

# 检查响应
if response.status_code == 201:
    print("Alert created successfully")
else:
    print("Failed to create alert:", response.text)