topic Re: alert not triggering in Alerting

alert not triggering

ips_mandar — Tue, 09 Jun 2020 22:07:08 GMT

Hi I was creating sample alert on index=_internal|stats count by host for last 15min
alert to be triggered on custom condition-

search count > 0

But I am unable to see any alert triggered.
Is there anything I am doing wrong?

Trigger Action-Add to triggered alerts

Re: alert not triggering

richgalloway — Thu, 02 Apr 2020 17:07:11 GMT

Are you looking at the Activity->Triggered Alerts page?

Re: alert not triggering

ips_mandar — Thu, 02 Apr 2020 17:08:11 GMT

Yes I am looking at Triggered alert Page.

Re: alert not triggering

cmerriman — Sat, 04 Apr 2020 01:33:07 GMT

Just to verify - the alert is enabled? When you run that search over 15 minutes, you get data? (I'd hope so since it's _internal)

Did you check the _internal scheduler logs to see if there was any error for this search? Skips or anything

Re: alert not triggering

ips_mandar — Fri, 17 Apr 2020 11:44:57 GMT

@cmerriman, I did verify and it is enable and returing data. I did try on other index as well but it seems alert trigger condition is not working. any idea?
same is happening on my production splunk server as well.