https://community.splunk.com/t5/Alerting/Have-I-properly-configured-advanced-conditional-attributes-for/m-p/233752#M4358 <P>Hi @KolGr001,<BR /> "Counttype" should not be specified if you are using an "alert_condition" in savedsearches.conf.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Savedsearchesconf">http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Savedsearchesconf</A></P> <P>The spec file mentions that, if you include an alert_condition, you should not set counttype, relation, or quantity. I've corrected a discrepancy in older versions of our documentation that stated otherwise. </P> <P>Hope this helps! </P> Sat, 14 Nov 2015 01:47:03 GMT frobinson_splun 2015-11-14T01:47:03Z https://community.splunk.com/t5/Alerting/Have-I-properly-configured-advanced-conditional-attributes-for/m-p/233751#M4357 <P>This is the first time I am using an advanced conditional alert in savedsearches.conf. </P> <P>I'd like to get some feedback about current configurations I have around monitoring scheduled jobs.</P> <P>If a job is hung for x amount of time, the alert should kick off, however one was manually suspended last night and nothing came out. Here is a sample of my savedsearches.conf along with a sample of the search:</P> <PRE><CODE>[alert] action.email.inline = 1 action.script = 1 action.script.filename = email_alert.sh alert.digest_mode = True alert.expires = 24h alert.suppress = 0 alert.track = 1 **alert_condition = | where last_run_ago_seconds&gt;7200 counttype = custom** cron_schedule = 00 09,10,11,12,13,14,15,16,17,18,19,20,21,22 * * * displayview = flashtimeline enableSched = 1 search = index=index earliest=-60m@m latest=@m sourcetype=blah &lt;servicenamehere&gt; | head 100 | stats latest(_time) as last_seen, first(host) as host_start by service | addinfo | eval last_run_ago_seconds=round( info_search_time-last_seen ) | stats min(last_run_ago_seconds) as last_run_ago_seconds, values(host_start) as host_start by service | fillnull value="n/a" host_start | eval message=if(last_run_ago_seconds&gt;7200, "This Job May Be Hung", "Job Looks OK") | table service,last_run_ago_seconds,host_start,message </CODE></PRE> <P>When I run the search manually things look OK, but I want to make sure my use of alert_condition and counttype are correct. Or, if there is another way of kicking off a similar alert I am open to suggestions.</P> <P>Thanks in advance!</P> Thu, 12 Nov 2015 15:01:37 GMT https://community.splunk.com/t5/Alerting/Have-I-properly-configured-advanced-conditional-attributes-for/m-p/233751#M4357 _gkollias 2015-11-12T15:01:37Z https://community.splunk.com/t5/Alerting/Have-I-properly-configured-advanced-conditional-attributes-for/m-p/233752#M4358 <P>Hi @KolGr001,<BR /> "Counttype" should not be specified if you are using an "alert_condition" in savedsearches.conf.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Savedsearchesconf">http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Savedsearchesconf</A></P> <P>The spec file mentions that, if you include an alert_condition, you should not set counttype, relation, or quantity. I've corrected a discrepancy in older versions of our documentation that stated otherwise. </P> <P>Hope this helps! </P> Sat, 14 Nov 2015 01:47:03 GMT https://community.splunk.com/t5/Alerting/Have-I-properly-configured-advanced-conditional-attributes-for/m-p/233752#M4358 frobinson_splun 2015-11-14T01:47:03Z