False alert received

[gp1234]

Am Gopinath. I have one small question. If am receiving a false alert from splunk. For an example- the data has to be transferred at 3am-4am and as per the cron it was transferred but still am getting a false alert for this data on a daily basis.

What is the better solution to stop the false alert. Kindly help me in this....

[ragedsparrow]

This is a super vague question. There are a lot of unknowns here.

This is what I would do to troubleshoot:
1. Look a the returned events in your alert. Find out what is actually triggering it.
2. Double-check your alert settings to make sure it is configured properly
3. Re-evaluate your SPL to determine that there is no issue in the search that would triggering false positives.
4. Check the logs to make sure there are no performance issues on your search head .

This is typically where I would recommend you to start, but there isn't a lot of information in your question so, this is all I can advise.