https://community.splunk.com/t5/Reporting/Missing-some-Real-Time-emails/m-p/141419#M3153 <P>Recently a real-time search and email alert has failed to fire consistently. I am fairly certain that this used to work for every event. Now for some real-time triggered events, no email is getting sent. I compare the splunk search to the emails I'm getting and I am definitely missing emails. The search string has not changed. Perhaps it's a performance issue? (I am using a JOIN but my splunk admin tells me the system has plenty of resources). I am mostly curious about how to troubleshoot something like this. Thank you. </P> Wed, 03 Jun 2015 14:35:16 GMT jat75 2015-06-03T14:35:16Z https://community.splunk.com/t5/Reporting/Missing-some-Real-Time-emails/m-p/141419#M3153 <P>Recently a real-time search and email alert has failed to fire consistently. I am fairly certain that this used to work for every event. Now for some real-time triggered events, no email is getting sent. I compare the splunk search to the emails I'm getting and I am definitely missing emails. The search string has not changed. Perhaps it's a performance issue? (I am using a JOIN but my splunk admin tells me the system has plenty of resources). I am mostly curious about how to troubleshoot something like this. Thank you. </P> Wed, 03 Jun 2015 14:35:16 GMT https://community.splunk.com/t5/Reporting/Missing-some-Real-Time-emails/m-p/141419#M3153 jat75 2015-06-03T14:35:16Z https://community.splunk.com/t5/Reporting/Missing-some-Real-Time-emails/m-p/141420#M3154 <P>Update: I created the same real time alert without using a join (however I do need a join) and I am getting more emails for that alert than the one with the join. Could this be a timing or resource thing?</P> Fri, 12 Jun 2015 12:56:44 GMT https://community.splunk.com/t5/Reporting/Missing-some-Real-Time-emails/m-p/141420#M3154 jat75 2015-06-12T12:56:44Z