Alert is not getting triggered

[bhepi01]

Hi People,

I created a sample app which works with uploaded data in splunk. The data has almost 1700 rows. This data is fixed. I created an alert which is based on triggered condition. The condition is number of results. I added condition in alert is number of results >0 in last one minute. when I do simple search like source="sourcename". Results are returning my 1700 rows.
But alert is not triggering. I don't see anything in alert activity( Triggered alert).
What am I missing here?

Thanks in advance
Bheem

[renjith_nair]

Few things to check :

• Are you running the same search as in alert in the search bar with 1 minute time range?
• Try adding index= in the SPL. It's possible that your search is not searching any index by default.
• Do you see any entries in the scheduler log about this alert ?

Have a look at http://wiki.splunk.com/Community:TroubleshootingScheduledSearches

[bhepi01]

I tried with index= also , I did not see any entries in scheduler log.

PS: I did not understand first point.

Please explain first point and I request to give some other points to debug this problem.

I am tired of this 😞

[renjith_nair]

Alright!
Select your app
Run your search in the search bar and check if the results are showing up
Save as alert and schedule the alert. Check the scheduler log for your alert

[bhepi01]

How much time do I need to select in scheduler alert ?