https://community.splunk.com/t5/Alerting/Alert-not-triggering/m-p/303126#M5454 <P>Hi,</P> <P>I'm trying to receive an alert if any of my hosts stop sending events for a period of time.</P> <P>The query <CODE>| metadata type=hosts | eval age=(recentTime-now()) | where age&lt;-1 | table host recentTime age | convert ctime(recentTime)</CODE> shows a number of results.</P> <P>I am creating a real-time alert from this query and setting it to trigger when the number of results is greater than 0.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4671i67998C039691CF97/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>The alert is not being triggered, even though the search query that it is built from is returning results.</P> <P>Obviously when I have worked it out I will increase the number of seconds that I compare "age" against, but now I can't work out why the alert is not being triggered.</P> <P>Thanks,<BR /> Andy</P> Wed, 04 Apr 2018 14:22:42 GMT andrewbeak 2018-04-04T14:22:42Z https://community.splunk.com/t5/Alerting/Alert-not-triggering/m-p/303126#M5454 <P>Hi,</P> <P>I'm trying to receive an alert if any of my hosts stop sending events for a period of time.</P> <P>The query <CODE>| metadata type=hosts | eval age=(recentTime-now()) | where age&lt;-1 | table host recentTime age | convert ctime(recentTime)</CODE> shows a number of results.</P> <P>I am creating a real-time alert from this query and setting it to trigger when the number of results is greater than 0.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4671i67998C039691CF97/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>The alert is not being triggered, even though the search query that it is built from is returning results.</P> <P>Obviously when I have worked it out I will increase the number of seconds that I compare "age" against, but now I can't work out why the alert is not being triggered.</P> <P>Thanks,<BR /> Andy</P> Wed, 04 Apr 2018 14:22:42 GMT https://community.splunk.com/t5/Alerting/Alert-not-triggering/m-p/303126#M5454 andrewbeak 2018-04-04T14:22:42Z https://community.splunk.com/t5/Alerting/Alert-not-triggering/m-p/303127#M5455 <P>Could you please read the answer provided in our community</P> <P><A href="https://answers.splunk.com/answers/509671/why-is-my-simple-alert-not-firing.html">https://answers.splunk.com/answers/509671/why-is-my-simple-alert-not-firing.html</A></P> <P><A href="https://answers.splunk.com/answers/223399/why-is-my-simple-alert-not-being-triggered-with-th.html">https://answers.splunk.com/answers/223399/why-is-my-simple-alert-not-being-triggered-with-th.html</A></P> <P>Hope it will help you</P> Wed, 04 Apr 2018 14:43:44 GMT https://community.splunk.com/t5/Alerting/Alert-not-triggering/m-p/303127#M5455 logloganathan 2018-04-04T14:43:44Z https://community.splunk.com/t5/Alerting/Alert-not-triggering/m-p/303128#M5456 <P>Thanks for the reply, but I'm not sure how to apply those answers. My search is real-time and so is my alert. I've also tried a rolling window for search and a scheduled alert.</P> <P><IMG src="https://image.ibb.co/ejnwjx/Screenshot_from_2018_04_04_16_36_56.png" alt="My search settings" /></P> Wed, 04 Apr 2018 15:39:49 GMT https://community.splunk.com/t5/Alerting/Alert-not-triggering/m-p/303128#M5456 andrewbeak 2018-04-04T15:39:49Z