Alerting

Ambiguous behavior of Splunk Alert

sarvesh_11
Communicator

I am getting alert in splunk, when i click the hyperlink "View Result in Splunk",
it is giving me the same what is there in the mail body.
But when i again run the same code for same time window, there is nothing, i.e just hit , the results disappear?
Also, they are false alerts. the correct output is shown when we are rerunning the query.

Now this is frightening, and looses confidence on Splunk. Though its not happening in repetitive manner, its unusual.
My code is :

| makeresults
| eval Field1="1,2,3,4,5"
| eval Field1=split(Field1,",")
| mvexpand Field1
| join type=left Field1
[ search index=x source="abc"(my source is database)
....]

and the code goes onn.
@gordo32 i have seen your inputs on this https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html. Do you think the "search" will also resolve my thing?

0 Karma

jawaharas
Motivator

Are you using relative time (say last 15 min, last 1 hour etc.,) for your search?

0 Karma

sarvesh_11
Communicator

@jawaharas Yes i am using Last 15minutes as time window and cron schedule of every 5minutes.

0 Karma

jawaharas
Motivator

Is your issue replicable when using absolute time range (from 'timerange' picker, select 'Date & Time Range) instead of relative time (last 15 min) ?

Also, can you share your full Splunk query?

0 Karma

sarvesh_11
Communicator

yes, it is replicable!
I am sorry, i cannot share the whole query.
I found something intereting in: https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html

Using "search" in alert was creating a problem, thankfully i get rid of it 🙂

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...