Alerting

Alert not triggering

andrewbeak
Path Finder

Hi,

I'm trying to receive an alert if any of my hosts stop sending events for a period of time.

The query | metadata type=hosts | eval age=(recentTime-now()) | where age<-1 | table host recentTime age | convert ctime(recentTime) shows a number of results.

I am creating a real-time alert from this query and setting it to trigger when the number of results is greater than 0.

alt text

The alert is not being triggered, even though the search query that it is built from is returning results.

Obviously when I have worked it out I will increase the number of seconds that I compare "age" against, but now I can't work out why the alert is not being triggered.

Thanks,
Andy

Tags (2)
0 Karma
1 Solution

andrewbeak
Path Finder

Thanks for the reply, but I'm not sure how to apply those answers. My search is real-time and so is my alert. I've also tried a rolling window for search and a scheduled alert.

My search settings

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...