Alerting

Alert not triggering

andrewbeak
Path Finder

Hi,

I'm trying to receive an alert if any of my hosts stop sending events for a period of time.

The query | metadata type=hosts | eval age=(recentTime-now()) | where age<-1 | table host recentTime age | convert ctime(recentTime) shows a number of results.

I am creating a real-time alert from this query and setting it to trigger when the number of results is greater than 0.

alt text

The alert is not being triggered, even though the search query that it is built from is returning results.

Obviously when I have worked it out I will increase the number of seconds that I compare "age" against, but now I can't work out why the alert is not being triggered.

Thanks,
Andy

Tags (2)
0 Karma
1 Solution

andrewbeak
Path Finder

Thanks for the reply, but I'm not sure how to apply those answers. My search is real-time and so is my alert. I've also tried a rolling window for search and a scheduled alert.

My search settings

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...