Alerting

Alerts not showing up

echalex
Builder

Hi,

I have a search running once an hour, which is configured to raise an alert and email me if events>0. Alert expiration is set to 24 hours. I get the emails, but the alerts do not show up in the "Alerts" link. Also, under "Manager > Searches & reports", the number of alerts stays at 0.

Why is that?

Tags (1)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

IIRC, the behavior you describe is "tracking", on the configuration page for the search that drives the alert. Tracking is a tick box that keeps track in the Manager UI. Otherwise, you just get the emails.

View solution in original post

0 Karma

sowings
Splunk Employee
Splunk Employee

IIRC, the behavior you describe is "tracking", on the configuration page for the search that drives the alert. Tracking is a tick box that keeps track in the Manager UI. Otherwise, you just get the emails.

0 Karma

echalex
Builder

Yup, that's it! Thanks!

0 Karma

glkadmins
New Member

Can you elaborate on enabling the tracking feature on alerts? I have setup an email alert and I am getting the emails but I cannot see the alert to modify it.

0 Karma

sai33
Explorer

Even i'm facing a similar situation. Any further pointers here!

0 Karma
Get Updates on the Splunk Community!

Alpha Launch: AI-Assisted Auto-Schematization for CIM

Streamlining Data Onboarding: Announcing the Alpha Release of AI-Assisted Auto-Schematization For many Splunk ...

Enterprise Security(ES) Essentials or Premier? Let's discuss Splunk ES Editions on ...

  Hi everyone, Last year at .conf25, we shared something exciting: Splunk Enterprise Security is evolving ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 5

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...