topic Re: Ambiguous behavior of Splunk Alert in Alerting

Ambiguous behavior of Splunk Alert

sarvesh_11 — Thu, 25 Jul 2019 18:38:11 GMT

I am getting alert in splunk, when i click the hyperlink "View Result in Splunk",
it is giving me the same what is there in the mail body.
But when i again run the same code for same time window, there is nothing, i.e just hit , the results disappear?
Also, they are false alerts. the correct output is shown when we are rerunning the query.

Now this is frightening, and looses confidence on Splunk. Though its not happening in repetitive manner, its unusual.
My code is :

and the code goes onn.
@gordo32 i have seen your inputs on this https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html. Do you think the "search" will also resolve my thing?

Re: Ambiguous behavior of Splunk Alert

jawaharas — Fri, 26 Jul 2019 06:31:25 GMT

Are you using relative time (say last 15 min, last 1 hour etc.,) for your search?

Re: Ambiguous behavior of Splunk Alert

sarvesh_11 — Fri, 26 Jul 2019 07:25:04 GMT

@jawaharas Yes i am using Last 15minutes as time window and cron schedule of every 5minutes.

Re: Ambiguous behavior of Splunk Alert

jawaharas — Thu, 01 Aug 2019 00:24:14 GMT

Is your issue replicable when using absolute time range (from 'timerange' picker, select 'Date & Time Range) instead of relative time (last 15 min) ?

Also, can you share your full Splunk query?

Re: Ambiguous behavior of Splunk Alert

sarvesh_11 — Mon, 05 Aug 2019 08:16:56 GMT

yes, it is replicable!
I am sorry, i cannot share the whole query.
I found something intereting in: https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html

Using "search" in alert was creating a problem, thankfully i get rid of it 🙂