topic Re: Alert period overlap? in Alerting

Alert period overlap?

cyfj — Mon, 07 Nov 2011 14:31:32 GMT

If an alert is scheduled for every 30 minutes to look back 30 minutes, does it search since the last report's idea of what "now" was, or does it just do current "now" minus 30 minutes?

The reason I ask is to know if alert conditions can be missed if they occur JUST AFTER a previous report was run, and CPU utilization or other situation delays the next report from running by a few seconds. If the report just goes back 30 minutes from then execution of the scheduled search, these just-after events would be missed.

Must I take precautions such as looking back 35 minutes for a 30 minute period? What is the behavior for alert conditions that are found in two consecutive scheduled searches?

Thanks!

Re: Alert period overlap?

Eqalis — Mon, 07 Nov 2011 16:39:28 GMT

Yes if you schedule a search to run every 30 min, it uses the current now each time though in later versions they use cron style timing so it is less of an issue. Splunk recommend allowing a generous 5 min for this in the alert scheduling. So in your case you would run the alert every 30 minutes from 35 min ago until 5 min ago.

If you want the report to show clean half hour blocks, schedule it to run at 5 past and 25 to the hour using custom/cron as

5,35 * * * *

Bob

Re: Alert period overlap?

cyfj — Mon, 07 Nov 2011 16:41:51 GMT

Thanks! Is the same entry returned in two consequtive runs treated any differently the second time, related to emailed alerts?

Re: Alert period overlap?

Eqalis — Mon, 07 Nov 2011 16:46:16 GMT

Consecutive searches are not compared unless you chose to alert only if a count rises or drops by a value. So if you are not careful, you will get duplicate data

Re: Alert period overlap?

Splunk_U — Tue, 18 Dec 2012 20:04:17 GMT

I want to run a particular search on every 15 mins like 9:00, 9:15, 9:30 9:45 in this way. How to do that?