How does splunk email alerting work..?


I have a search scheduled to send an email alert when count > 10 in an hour timespan.

index=webserver sourcetype=web_logs  loglevel=error  | stats count by user | where count > 10 

let's say if i schedule this alert at @8am to run every hour, how does the hourly cycle works to fire an email alert..?

If count is > 10 @9:30am, will i get notified via email alert @9:30 or 10am..?

0 Karma


hi mcnamara,

using what operating system?
if you use Windows, try to change and use Linux because Linux includes a default mail management service.

and if it not work is that the condition for triggering the alert has not been met. trying to change the condition to see if you have emails in return before giving your starting condition.

0 Karma


If you schedule it every 1 hour , the search will run only at every hour. So if you schedule at just before 8am, it will execute at 8 am,then 9 am,then 10 am and so on. So at the time of execution(hour) if the condition satisfies, it sends alert. If you want to check if any error has happened after the last schedule, then your search should look from earliest=-1h latest=now to include all events for last one hours.

Hope I could explain!

Happy Splunking!
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...