https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232090#M12041 <P>I've hit a similar issue to the one you mention in an older Splunk version, re-creating the alert again (with identical configuration) fixed the issue, also upgrading to the current Splunk release (6.5.1) has not resulted in a re-occurence of the issue.</P> <P>In my case the alert script failed to fire sometimes, even though the alert itself fired, it's not a common problem so it may or may not be the same as the issue you are describing...just a potential answer.</P> Fri, 20 Jan 2017 08:04:00 GMT gjanders 2017-01-20T08:04:00Z https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232087#M12038 <P>Hi all, <BR /> I have deployment environment with:<BR /> 5 search heads, 3 Indexers, 2 Heavy forwarders and 1 cluster master.</P> <P>I created the alert on one of the search head with "Cron schedule" and "Run a script" action.<BR /> The problem begins after a few days when suddenly the script doesn't run!</P> <P>What checked: <BR /> 1. search lookup who trigger the script does work.<BR /> 2. index=_internal sourcetype="splunk_python" | search "my_script_name" - Does not appear!<BR /> Splunk stop running the script after a few days, despite that the search trigger works!<BR /> Any insight? What steps do we need to take to the run a script function work in such deployment environment ?</P> Tue, 29 Sep 2020 12:24:21 GMT https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232087#M12038 bugnet 2020-09-29T12:24:21Z https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232088#M12039 <P>Okay, so if the script worked for a few days, then stopped working, I'd start out by checking whether the components (bin etc) were all in place. </P> <P>There are lots of production environments where the security team will UNDO work which has not been properly documented, without giving notice. There are also lots of pseudo-production environments where people muck with each other's code, also without giving notice. </P> Wed, 18 Jan 2017 15:01:45 GMT https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232088#M12039 DalJeanis 2017-01-18T15:01:45Z https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232089#M12040 <P>Thanks. all components are in place.</P> Thu, 19 Jan 2017 09:30:14 GMT https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232089#M12040 bugnet 2017-01-19T09:30:14Z https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232090#M12041 <P>I've hit a similar issue to the one you mention in an older Splunk version, re-creating the alert again (with identical configuration) fixed the issue, also upgrading to the current Splunk release (6.5.1) has not resulted in a re-occurence of the issue.</P> <P>In my case the alert script failed to fire sometimes, even though the alert itself fired, it's not a common problem so it may or may not be the same as the issue you are describing...just a potential answer.</P> Fri, 20 Jan 2017 08:04:00 GMT https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232090#M12041 gjanders 2017-01-20T08:04:00Z https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232091#M12042 <P>check the expiry option </P> Mon, 06 Mar 2017 06:16:55 GMT https://community.splunk.com/t5/Alerting/Splunk-stop-runing-the-alert-script-after-a-few-days-despite/m-p/232091#M12042 puneethgowda 2017-03-06T06:16:55Z