topic Re: Alert in Monitoring Splunk

Alert

uagraw01 — Mon, 28 Dec 2020 12:57:07 GMT

Hello Members,

I need some suggestions and help. As per my screenshot we can see my events is skipped from 7:17 pm to 8:17 pm. So because of that user complaint for not getting any alerts during that period. Please suggest me how can i further troubleshoot this issue and find out the reason.

Re: Alert

richgalloway — Mon, 28 Dec 2020 14:00:30 GMT

Verify Splunk was running at the time.

Check the Monitoring Console for skipped searches around 8:17.

Re: Alert

uagraw01 — Mon, 28 Dec 2020 15:43:45 GMT

@richgalloway Our application is on Heavy forwarder. And i can see skipped event on HF as showned below and we are using splunk cloud. So please suggest me how can verify exactly with the event .

And how can i maintain my infrastructure HF. If any documents please share with me. Because i need to create an alert when the event count is less in HF then that alert will trigger.

Re: Alert

richgalloway — Mon, 28 Dec 2020 22:03:04 GMT

There is nothing "shown below".

If you're seeing skipped searches then you need to find the cause of the skips and remedy it. Most often the cause is too many searches trying to run at the same time. Changes the schedules of your saved searches and alerts so you don't have too many running at once.

Heavy forwarders should not be running searches at all. They should be running on your cloud or hybrid search head.