topic Re: Simple alert still does not fire in Alerting

Simple alert still does not fire

pkurt — Sun, 03 Apr 2016 03:58:17 GMT

Hello everyone,

I had trouble last year making a simple alert work in Splunk (topic: "Simple alert not working?"). I could not make it work so I used Python SDK and alerted using python. Now I want to try to make Splunk alert again. I have tried many simple tests, and I have never successfully made an alert fire. I must be doing something simple wrong.

I have streaming data that comes constantly. Can anyone suggest a trivial alert test I can try that can work?
For example, I try a search for all data on my index and get hundreds of results in most recent few minutes. Then I click "save as" and select "alert". I select to have alert type scheduled from Cron Schedule, and tell it to run every minute (* * * * *). I choose "trigger alert when" I select "number of results" and select "is greater than" with value "0". For trigger action I ask it to send me an e-mail.

I save the alert and it appears in my alerts list. But no longer how long I wait I never get an e-mail and the alert always says "There are no fired events for this alert". I have tried other Cron selections. I have also tried using "Real-time" instead of Cron Schedule, but it still does not fire.

Does anyone know how to make it fire?

Thank you very much for any help,
Pelin

Re: Simple alert still does not fire

woodcock — Sun, 03 Apr 2016 14:49:09 GMT

Try this:

|noop|stats count|eval count = count + 1

Then trigger your alert to fire for Number of events greater than 0 and set it for every 5 minutes. Don't assume the email will to through but check for triggered alerts from the Alerts screen.

Re: Simple alert still does not fire

pkurt — Sun, 03 Apr 2016 18:00:19 GMT

Thank you very much! I made this work on a different server. My first server has problems right now. Will try there too when it is working again.

But the e-mail does not work now. It is listed in the triggered alerts like you said. But no e-mail was sent. Do you know why the e-mail might not be working?

Re: Simple alert still does not fire

woodcock — Sun, 03 Apr 2016 18:11:03 GMT

If you have admin privileges on your Search Head, go to Settings -> Server settings -> Email settings. Here is blog that shows how to use gmail:

http://blogs.splunk.com/2014/06/27/splunk-alerts-using-gmail-twitter-phone-calls-and-much-more/

Re: Simple alert still does not fire

woodcock — Sun, 03 Apr 2016 18:11:18 GMT

don't forget to click "Accept".

Re: Simple alert still does not fire

pkurt — Mon, 04 Apr 2016 03:28:27 GMT

Thank you very much, it worked!!!