topic Re: Alert is not getting triggered in Alerting

Alert is not getting triggered

bhepi01 — Sat, 17 Sep 2016 17:50:48 GMT

Hi People,

I created a sample app which works with uploaded data in splunk. The data has almost 1700 rows. This data is fixed. I created an alert which is based on triggered condition. The condition is number of results. I added condition in alert is number of results >0 in last one minute. when I do simple search like source="sourcename". Results are returning my 1700 rows.
But alert is not triggering. I don't see anything in alert activity( Triggered alert).
What am I missing here?

Thanks in advance
Bheem

Re: Alert is not getting triggered

renjith_nair — Sun, 18 Sep 2016 04:09:24 GMT

Few things to check :

Are you running the same search as in alert in the search bar with 1 minute time range?
Try adding index= in the SPL. It's possible that your search is not searching any index by default.
Do you see any entries in the scheduler log about this alert ?

Have a look at http://wiki.splunk.com/Community:TroubleshootingScheduledSearches

Re: Alert is not getting triggered

bhepi01 — Sun, 18 Sep 2016 09:11:56 GMT

I tried with index= also , I did not see any entries in scheduler log.

PS: I did not understand first point.

Please explain first point and I request to give some other points to debug this problem.

I am tired of this 😞

Re: Alert is not getting triggered

renjith_nair — Sun, 18 Sep 2016 13:47:49 GMT

Alright!
Select your app
Run your search in the search bar and check if the results are showing up
Save as alert and schedule the alert. Check the scheduler log for your alert

Re: Alert is not getting triggered

bhepi01 — Sun, 18 Sep 2016 13:57:14 GMT

How much time do I need to select in scheduler alert ?