topic Re: Real time alerts in Alerting

Real time alerts

christinmb — Thu, 03 Jan 2013 23:16:35 GMT

Im having problems with the real time alerts, splunk is not sending all the events by email, it works fine in the first 3 minuts, but after that Im not getting any email or events in the alert manager, but if i schedule that same search but dont make it rt search it does work and I get all my alerts in my inbox.
This problem started after I upgrade to Splunk 5, with Splunk 4.x I didnt have that problem

Re: Real time alerts

BobDaMann — Fri, 04 Jan 2013 04:49:53 GMT

Could you provide more information? I'd like to know a little bit more about the alert you have set up.

Perhaps a screenshot of the alert settings?

Are you using throttling?

Re: Real time alerts

christinmb — Fri, 04 Jan 2013 14:41:48 GMT

https://dl.dropbox.com/u/97076067/df.png thats the configuration I have

Re: Real time alerts

christinmb — Fri, 04 Jan 2013 17:40:45 GMT

It was an error in the "per results throttling fields" and the alerting mode, thanks!

Re: Real time alerts

BobDaMann — Fri, 04 Jan 2013 17:54:32 GMT

Awesome. Well I am glad I was able to help. Take it easy.