topic Re: Alert not working in Alerting

Alert not working

trueclicks — Mon, 17 Oct 2016 09:39:17 GMT

Hi,

easy alert ( see bellow ) is not working.

Condition meets the criteria.

Mail Server Settings are set by default ( spunk little).
Alert is triggered
Mail is not sent.
Alert action is empty. Why ?

Do I do something wrong ? or is it bug ?

Thanks for answers / ideas / recommendations.

Re: Alert not working

dkoshe_splunk — Mon, 24 Oct 2016 01:18:20 GMT

Hello,

Have you looked into splunk logs to find out if there is an error in sending emails?
Also there are a lot of answers queries around troubleshooting emails not getting sent.
See for example:
https://answers.splunk.com/answers/330817/how-to-troubleshoot-why-im-not-getting-email-alert.html
https://answers.splunk.com/answers/32498/how-to-troubleshoot-splunk-email-notification.html
https://answers.splunk.com/answers/221223/how-to-troubleshoot-why-i-am-not-receiving-emails.html
https://answers.splunk.com/answers/225648/alert-email-not-being-sent.html

Hope this helps.
-Dhananjay

Re: Alert not working

hardikJsheth — Tue, 29 Sep 2020 11:35:08 GMT

From the screen shot splunk2.png, it looks like that when the alert run it did not return any result. That's why you have result_count="0" and alert_action="".

Please check if you are getting the results. Also check the condition of your scheduled search, on what condition do you fire an alert.

Re: Alert not working

gcusello — Mon, 24 Oct 2016 10:58:09 GMT

Hi trueclicks,
I assume that you verified that your system correctly sends eMails.
Sometimes the problem is that the results are too large for the eMail body or the eMail attachment so the eMail is blocked by the mail server.
So verify unflagging attachment and results in the eMail Body.
Bye.
Giuseppe

Re: Alert not working

trueclicks — Thu, 03 Nov 2016 08:09:10 GMT

Thank you. Problem was in my scheduled search. I wanted to fire event when the search did not have any result.
This helped:
https://answers.splunk.com/answers/127905/set-count-to-0-if-no-results-found-in-splunk-alert.html

Re: Alert not working

trueclicks — Thu, 03 Nov 2016 08:09:30 GMT

Thank you for you help.

Re: Alert not working

trueclicks — Thu, 03 Nov 2016 08:09:47 GMT

Thank you for your help.