https://community.splunk.com/t5/Alerting/False-alert-received/m-p/420854#M7337 <P>This is a super vague question. There are a lot of unknowns here. </P> <P>This is what I would do to troubleshoot:<BR /> 1. Look a the returned events in your alert. Find out what is actually triggering it.<BR /> 2. Double-check your alert settings to make sure it is configured properly<BR /> 3. Re-evaluate your SPL to determine that there is no issue in the search that would triggering false positives.<BR /> 4. Check the logs to make sure there are no performance issues on your search head .</P> <P>This is typically where I would recommend you to start, but there isn't a lot of information in your question so, this is all I can advise.</P> Thu, 01 Aug 2019 13:57:52 GMT ragedsparrow 2019-08-01T13:57:52Z https://community.splunk.com/t5/Alerting/False-alert-received/m-p/420853#M7336 <P>Am Gopinath. I have one small question. If am receiving a false alert from splunk. For an example- the data has to be transferred at 3am-4am and as per the cron it was transferred but still am getting a false alert for this data on a daily basis.</P> <P>What is the better solution to stop the false alert. Kindly help me in this....</P> Thu, 01 Aug 2019 13:26:04 GMT https://community.splunk.com/t5/Alerting/False-alert-received/m-p/420853#M7336 gp1234 2019-08-01T13:26:04Z https://community.splunk.com/t5/Alerting/False-alert-received/m-p/420854#M7337 <P>This is a super vague question. There are a lot of unknowns here. </P> <P>This is what I would do to troubleshoot:<BR /> 1. Look a the returned events in your alert. Find out what is actually triggering it.<BR /> 2. Double-check your alert settings to make sure it is configured properly<BR /> 3. Re-evaluate your SPL to determine that there is no issue in the search that would triggering false positives.<BR /> 4. Check the logs to make sure there are no performance issues on your search head .</P> <P>This is typically where I would recommend you to start, but there isn't a lot of information in your question so, this is all I can advise.</P> Thu, 01 Aug 2019 13:57:52 GMT https://community.splunk.com/t5/Alerting/False-alert-received/m-p/420854#M7337 ragedsparrow 2019-08-01T13:57:52Z