Alerting

Alert not getting triggered with cron schedule

praddasg
Path Finder

Hello All,

I have configured an alert with earliest=-24h and head 3000 and i can see from search there are lot of results are populating but I am no alerts are getting generated. Alert threshold is greater than 2 and results populating are 77
I have integrated the alert with splunk. At first I thought it might the integration is broken but I am verifying from here activity->triggered alerts but i do not see anything
https://share.getcloudapp.com/kpuYKLmd

I am not sure if this due to the cron and other settings, so here it is
https://share.getcloudapp.com/o0uD6gyX

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

You need to add alert action "Add to Triggered Alerts" to your alert then it'll appear in Activity->Triggered Alerts with severity set in alert action.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

You need to add alert action "Add to Triggered Alerts" to your alert then it'll appear in Activity->Triggered Alerts with severity set in alert action.

praddasg
Path Finder

It seems the splunk integration was broken because I did not include some text in the message section. All sorted and thanks for your help

0 Karma

praddasg
Path Finder

although I am using earliest but i still changed the time range from alert configuration to 2 mins (earlier it was 12 hours) still no luck

0 Karma

skoelpin
SplunkTrust
SplunkTrust

What alert actions do you have tied to the alert? How sure are you that it fired but you did not notice? Have you checked the internal logs to verify if it fired?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...