How does splunk email alerting work..?

[prakash007]

I have a search scheduled to send an email alert when count > 10 in an hour timespan.

index=webserver sourcetype=web_logs  loglevel=error  | stats count by user | where count > 10 

let's say if i schedule this alert at @8am to run every hour, how does the hourly cycle works to fire an email alert..?

If count is > 10 @9:30am, will i get notified via email alert @9:30 or 10am..?

[gyslainlatsa]

hi mcnamara,

using what operating system?
if you use Windows, try to change and use Linux because Linux includes a default mail management service.

and if it not work is that the condition for triggering the alert has not been met. trying to change the condition to see if you have emails in return before giving your starting condition.

[renjith_nair]

If you schedule it every 1 hour , the search will run only at every hour. So if you schedule at just before 8am, it will execute at 8 am,then 9 am,then 10 am and so on. So at the time of execution(hour) if the condition satisfies, it sends alert. If you want to check if any error has happened after the last schedule, then your search should look from earliest=-1h latest=now to include all events for last one hours.

Hope I could explain!