https://community.splunk.com/t5/Alerting/Alerts-problem-on-6-1-1/m-p/185143#M3096 <P>Since I upgraded SPLUNK to 6.1, I have a problem with my alerts.<BR /> After few hours they stop working. I must restart SPLUNK and my alerts are back to work until they stop working.<BR /> How can I resolve that ?</P> Mon, 02 Jun 2014 11:53:45 GMT macewindum 2014-06-02T11:53:45Z https://community.splunk.com/t5/Alerting/Alerts-problem-on-6-1-1/m-p/185143#M3096 <P>Since I upgraded SPLUNK to 6.1, I have a problem with my alerts.<BR /> After few hours they stop working. I must restart SPLUNK and my alerts are back to work until they stop working.<BR /> How can I resolve that ?</P> Mon, 02 Jun 2014 11:53:45 GMT https://community.splunk.com/t5/Alerting/Alerts-problem-on-6-1-1/m-p/185143#M3096 macewindum 2014-06-02T11:53:45Z https://community.splunk.com/t5/Alerting/Alerts-problem-on-6-1-1/m-p/185144#M3097 <P>Ran into this over the weekend myself. It looks to be known issue SPL-84357</P> <P>The response I found at <BR /> <A href="http://answers.splunk.com/answers/137421/why-are-my-real-time-alerting-searches-no-longer-sending-emails-for-matching-events-after-upgrading-to-61">http://answers.splunk.com/answers/137421/why-are-my-real-time-alerting-searches-no-longer-sending-emails-for-matching-events-after-upgrading-to-61</A><BR /> provided the following workaround:</P> <P>The work-around is to temporarily extend "sessionTimeout" in $SPLUNK_HOME/etc/system/local/server.conf to a value that will be longer than the interval between two matched events, thus preventing the token from expiring:<BR /> [general]<BR /> sessionTimeout = 30d</P> Mon, 02 Jun 2014 12:14:58 GMT https://community.splunk.com/t5/Alerting/Alerts-problem-on-6-1-1/m-p/185144#M3097 mtranchita 2014-06-02T12:14:58Z https://community.splunk.com/t5/Alerting/Alerts-problem-on-6-1-1/m-p/185145#M3098 <P>Thanks for the answer.</P> Mon, 02 Jun 2014 12:29:56 GMT https://community.splunk.com/t5/Alerting/Alerts-problem-on-6-1-1/m-p/185145#M3098 macewindum 2014-06-02T12:29:56Z