topic Re: why RealTime Alert is not triggering ? in Alerting

why RealTime Alert is not triggering ?

ajitshukla61116 — Thu, 04 Jul 2019 11:28:22 GMT

can anybody tell me what are the capability required to search and trigger the realtime alert.
When I configured realtime alert with admin account its working fine but when it`s configured with normal user account its not working.

My scheduled alert working fine with normal user account .

please tell me what could be the reason for this .

Re: why RealTime Alert is not triggering ?

vishaltaneja070 — Fri, 05 Jul 2019 12:22:10 GMT

Hello @ajitshukla61116

You need to assign user schedule_rtsearch capability
Please find the below link which can give you better idea:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Security/Rolesandcapabilities

Re: why RealTime Alert is not triggering ?

woodcock — Sat, 06 Jul 2019 22:13:41 GMT

Most admins deliberately disable all realtime capabilities because these searches are so horrifically detrimental to the Search Head.

Re: why RealTime Alert is not triggering ?

ajitshukla61116 — Mon, 08 Jul 2019 02:10:21 GMT

already assigned schedule_rtsearch but still I am not able to get real time alert.

Re: why RealTime Alert is not triggering ?

vishaltaneja070 — Mon, 08 Jul 2019 11:09:50 GMT

@ajitshukla

Can you please check the internal logs and see if they are getting spiked because of hardware restrictions.