topic Re: Splunk notification Issues in Reporting

Splunk notification Issues

sreejithpoothu — Fri, 09 Nov 2012 17:48:06 GMT

Hi,

I have a scheduled search for ERROR from particular log which runs every hour and if there is any error will send alert through mail.But in some times we are getting mail only after 3 or 4 hours when error happens.If an error happens on 1:00am, we are getting notification at 5 am not at 2:00am as per the schedule.I dont have any clue how to debug this.Please help?

Regards
Sreejith.A

Re: Splunk notification Issues

jbsplunk — Fri, 09 Nov 2012 18:16:54 GMT

You can use the instructions here to troubleshoot what is happening:

http://splunk-base.splunk.com/answers/32498/how-to-troubleshoot-splunk-email-notification

Re: Splunk notification Issues

sreejithpoothu — Fri, 09 Nov 2012 19:22:05 GMT

We didnt see any error from logs.The issue is that our forwader is on UTC and indexer is on EST.When error happens on 01:00UTC ,splunk sends mail at 01:00 EST.Is ther any way we can fix this?