Alerting

Alert when "rises by" issue

hbazan
Path Finder

Hi. I have scheduled a search to run on midnight, and I need to send a mail if the number of returned events is greater than the day before. I've configured this: Schedule type: Basic Run every: Day at midnight

Alert conditions Perform actions: If number of events Rises by 1

Alert actions Send email

Either I've misinterpreted the "rises by" setting, or it's not working. Because I've run the search yesterday getting 6 events, and run it today and I've got 9 events, but splunk didn't send the alert. Any thoughts?

Tags (2)

Genti
Splunk Employee
Splunk Employee

Hey HB.
I cannot tell from your question if the search ran automatically (scheduled) the first time or not but, the way rises by works is this:

Day 0: You automatically run a search and get 5 results
Day 1: You decide to schedule this search and alert you if the events rise. This search returns 8 results but will not alert you, because there is no baseline for this search to compare the 8 results to.
Day 2: The search runs again, this time returning 10 events, and SHOULD alert you, since 10 -8 = 2 >1. In this second scheduled run, there is a baseline of 8 to compare to and an alert should be triggered.

If this is not the behavior you are seeing then you might want to test your email alerting capabilities. If those are working, then perhaps a case with our support should be opened and a diag attached to the case.

Hope this helps,
Cheers!
.gz

hbazan
Path Finder

Hi Genti.
I think I've found the issue. If I go to Jobs and filter this saved search, the number of events for last two runs says "0", but if I open the results I do have events (but above the flashtimeline says "0 matching events"). And if I re-run the search (on the same window) the results I got the same results but the "matching events" is right. Maybe that's what's avoiding the alarm to run?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...