Alerting

Alert not triggered

uagraw01
Builder

In my case alert is not triggered when particular log is generated. So i checked that the person who created that alert previously has no permission for scheduler search when i verify from internal logs and beacuse of this i am not able to see any view result for job runs. So please suggest if i will create new alert by with all scheduled search permission, so it will get resolve or not ?

Means schedule search is directly proportional to alert triggered ?

 

 

Labels (1)
0 Karma
1 Solution

anilchaithu
Builder

@uagraw01 

Yes. and obviously it has to meet the alert conditions.

 

View solution in original post

0 Karma

anilchaithu
Builder

@uagraw01 

Alerts will be triggered if 

  • scheduled job runs without errors. 
  • specified alert condition met

Its always better to run the search manually to check for syntax, run time errors. and also check for alert conditions.

I am still wondering how the user without schedule_search capability was able to schedule in the first place. 

You can assign the alert to you (reassign knowledge objects) so that it runs with your capabilities.

Hope this helps.

 

0 Karma

uagraw01
Builder

So if i have capabilities of schedule_search, then it will get resolve the issue ?

0 Karma

anilchaithu
Builder

@uagraw01 

Yes. and obviously it has to meet the alert conditions.

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...