topic Re: How does splunk email alerting work..? in Alerting

How does splunk email alerting work..?

prakash007 — Fri, 29 Jan 2016 03:59:35 GMT

I have a search scheduled to send an email alert when count > 10 in an hour timespan.

index=webserver sourcetype=web_logs  loglevel=error  | stats count by user | where count > 10

let's say if i schedule this alert at @8am to run every hour, how does the hourly cycle works to fire an email alert..?

If count is > 10 @9:30am, will i get notified via email alert @9:30 or 10am..?

Re: How does splunk email alerting work..?

renjith_nair — Fri, 29 Jan 2016 05:32:59 GMT

If you schedule it every 1 hour , the search will run only at every hour. So if you schedule at just before 8am, it will execute at 8 am,then 9 am,then 10 am and so on. So at the time of execution(hour) if the condition satisfies, it sends alert. If you want to check if any error has happened after the last schedule, then your search should look from earliest=-1h latest=now to include all events for last one hours.

Hope I could explain!

Re: How does splunk email alerting work..?

gyslainlatsa — Fri, 29 Jan 2016 08:22:29 GMT

hi mcnamara,

using what operating system?
if you use Windows, try to change and use Linux because Linux includes a default mail management service.

and if it not work is that the condition for triggering the alert has not been met. trying to change the condition to see if you have emails in return before giving your starting condition.