topic Re: Alerts not working in Alerting

Alerts not working

ridutta — Fri, 05 Jan 2018 09:01:07 GMT

I have enabled few alerts and these are the criterias:

Alert Type: Scheduled by CRON
Time Range: 24 Hours
Cron Expression: * */4 * * *

So as per this expression: The search query will run every 4 hour for the last 24 hours and trigger alerts. (Mail in my case)

Last day my search event count was 350. So why it didnt trigger after it crossed the 120 mark?

Can any one help me on this?

Re: Alerts not working

MousumiChowdhur — Fri, 05 Jan 2018 09:34:10 GMT

Hi! Can you please modify your cron expression with 0 */4 * * * and check if that's working?

Re: Alerts not working

ridutta — Fri, 05 Jan 2018 09:36:25 GMT

My cron expression is that only "0 */4 * * *"... but its not working. there is someting with this portal... However the suggested one is my cron expression.

Re: Alerts not working

MousumiChowdhur — Fri, 05 Jan 2018 09:43:22 GMT

Can you mention the search and the alert conditions you have configured, so that it's easier to find the solution.

Re: Alerts not working

ridutta — Tue, 29 Sep 2020 17:29:54 GMT

Current Search Query:
(index=mesb "Status_c=ERROR") source="*/mule-app-csone_logging_v2.0-v201712091010.log" Attribute_1c=CM_ROLE_UNAVAILABLE | eval _time=strptime(CreatedDate, "%Y-%m-%dT%H:%M:%S.%3N%Z") | timechart span=1h count by Attribute_1_c

Should I change to :
(index=mesb "Status_c=ERROR") source="*/mule-app-csone_logging_v2.0-v201712091010.log" Attribute_1c=CM_ROLE_UNAVAILABLE | timechart span=1h count by Attribute_1_c??

Re: Alerts not working

MousumiChowdhur — Fri, 05 Jan 2018 09:55:44 GMT

Yes, you should try the 2nd search, set the alert and check.

Re: Alerts not working

mayurr98 — Fri, 05 Jan 2018 10:09:25 GMT

Can you put the search query in 101010 sample code format? Also, are you setting any threshold on the number of results? I see from your question that 120 is the threshold.
My advice is to set the threshold in a query itself and just create an alert as it is without setting any threshold on the UI.