Alerts not triggering, but the same search has results



I have 6 Alerts that run on a schedule. Only one of them is working. If I run the search results come back that match. Why would they not be triggering?


Labels (2)
0 Karma

Esteemed Legend

Hi @bazcurtis178,

did you tested the searches without results in the same time period or after when you checked it?

Please try to run it in the same time period of the schedules alert.




I think I have cracked it. I think the data coming into index could come in and miss the alert. I have now tweaked the alerts to be cron jobs and I am collecting the data a little more quickly, 15 minutes instead of 20. Thanks for the help.

0 Karma


I have been checking them minutes after they should trigger. If they should trigger at 20 minutes past the hour I was checking at 25 minutes past.

I have changed them to cron jobs now rather than the GUI x past the hour option. One has already triggered.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...