Alerting
Highlighted

Alerts not working

New Member

I have enabled few alerts and these are the criterias:

Alert Type: Scheduled by CRON
Time Range: 24 Hours
Cron Expression: * */4 * * *

So as per this expression: The search query will run every 4 hour for the last 24 hours and trigger alerts. (Mail in my case)

Last day my search event count was 350. So why it didnt trigger after it crossed the 120 mark?

Can any one help me on this?

0 Karma
Highlighted

Re: Alerts not working

Contributor

Hi! Can you please modify your cron expression with 0 */4 * * * and check if that's working?

0 Karma
Highlighted

Re: Alerts not working

New Member

My cron expression is that only "0 */4 * * *"... but its not working. there is someting with this portal... However the suggested one is my cron expression.

0 Karma
Highlighted

Re: Alerts not working

Contributor

Can you mention the search and the alert conditions you have configured, so that it's easier to find the solution.

0 Karma
Highlighted

Re: Alerts not working

New Member

Current Search Query:
(index=mesb "Statusc=ERROR") source="*/mule-app-csoneloggingv2.0-v201712091010.log" Attribute_1c=CMROLEUNAVAILABLE | eval time=strptime(CreatedDate, "%Y-%m-%dT%H:%M:%S.%3N%Z") | timechart span=1h count by Attribute1__c

Should I change to :
(index=mesb "Statusc=ERROR") source="*/mule-app-csoneloggingv2.0-v201712091010.log" Attribute_1c=CMROLEUNAVAILABLE | timechart span=1h count by Attribute1_c??

0 Karma
Highlighted

Re: Alerts not working

Contributor

Yes, you should try the 2nd search, set the alert and check.

0 Karma
Highlighted

Re: Alerts not working

SplunkTrust
SplunkTrust

Can you put the search query in 101010 sample code format? Also, are you setting any threshold on the number of results? I see from your question that 120 is the threshold.
My advice is to set the threshold in a query itself and just create an alert as it is without setting any threshold on the UI.

0 Karma