https://community.splunk.com/t5/Alerting/Alert-Condition-and-Indexer/m-p/105571#M1508 <P>I've added missing infos in question</P> Tue, 24 Jul 2012 07:59:02 GMT rzessin 2012-07-24T07:59:02Z https://community.splunk.com/t5/Alerting/Alert-Condition-and-Indexer/m-p/105569#M1506 <P>I have a saved search which triggeres if there are are less than 2 items within an hour.<BR /> Sometimes the Trigger happens but the condition wasn't true. The file contains the items,<BR /> but the indexer has not made the work for hours, last time it was true for 17 hours.</P> <P>I've nothing found in logs, maybe I've looked in wrong place, is there any chance to see if indexex get stucks to see on which file ?</P> <P>Definition of scheduled Search:</P> <P><CODE><BR /><BR /> [CRL-Copy]<BR /> action.email = 1<BR /> action.email.inline = 1<BR /> action.email.sendresults = 1<BR /> action.email.subject = [Splunk Alert: $name$]<BR /> action.email.to = <REMOVED><BR /> alert.suppress = 0<BR /> alert.track = 1<BR /> counttype = number of events<BR /> cron_schedule = */30 * * * *<BR /> dispatch.earliest_time = -60m<BR /> dispatch.latest_time = now<BR /> displayview = flashtimeline<BR /> enableSched = 1<BR /> quantity = 2<BR /> relation = less than<BR /> request.ui_dispatch_view = flashtimeline<BR /> search = CRL-copy sourcetype="syslog-ng-modified" host="<EDITED>" ok<BR /> </EDITED></REMOVED></CODE></P> <HR /> <P>The intention is if the Certificate Revocation List isn't published at least one time in past hour an alert has t be sent. The CRL-Copy-Task itselfs run each 15 minutes via cron</P> <P>And if i doing the search now I see for each hour bound to quarter the four entries which is telling me that the indexer has got stuck.</P> Mon, 28 Sep 2020 12:07:50 GMT https://community.splunk.com/t5/Alerting/Alert-Condition-and-Indexer/m-p/105569#M1506 rzessin 2020-09-28T12:07:50Z https://community.splunk.com/t5/Alerting/Alert-Condition-and-Indexer/m-p/105570#M1507 <P>What are the search that you used to alert, the condition and the schedule ?</P> <P>Were the events searchable in splunk, with the correct timestamp ?</P> Mon, 23 Jul 2012 18:16:41 GMT https://community.splunk.com/t5/Alerting/Alert-Condition-and-Indexer/m-p/105570#M1507 yannK 2012-07-23T18:16:41Z https://community.splunk.com/t5/Alerting/Alert-Condition-and-Indexer/m-p/105571#M1508 <P>I've added missing infos in question</P> Tue, 24 Jul 2012 07:59:02 GMT https://community.splunk.com/t5/Alerting/Alert-Condition-and-Indexer/m-p/105571#M1508 rzessin 2012-07-24T07:59:02Z