topic Re: Alert doesn't run each minute in Alerting

Alert doesn't run each minute

mclane1 — Tue, 18 May 2021 16:23:53 GMT

Hello,

I created a small alert compiling data per minute for the last 24 hours:

I configure the alert with earliest=-5m and latest=now

Schedule window : 0

I try with and without acceleration without success.

I schedule my search : * * * * *

Expiration : I keep 1 h of alerts

The alert runs correctly but, it runs each 5 to 10 minutes.

I see in tasks the execution time is less than 15s (between 6 and 15 sec) :

The goal : another alert must run each 5 min and must look last 2h to generate alerts. Directly on the real time the alert duration is 3 min. I hope the inspect the "lookup" is quicker.

Re: Alert doesn't run each minute

anthonymelita — Tue, 18 May 2021 23:01:05 GMT

Have you checked the audittrail rather than relying on the UI?

index=_audit sourcetype=audittrail action="search" info="completed" savedsearch_name=[your alert]

Re: Alert doesn't run each minute

mclane1 — Wed, 19 May 2021 14:53:35 GMT

Hello,

Sorry, I'm using splunk 6.4.2

I find this command :

index=_internal "INFO StreamedSearch - Streamed search connection terminated" savedsearch_name="My_Alert" | table _time, search_id, server, active_searches, elapsedTime, search, savedsearch_name

And the frequency is the same. I schedule a mail for each alert, and it's the same in my outlook than on splunk.