How does splunk email alerting work..?


I have a search scheduled to send an email alert when count > 10 in an hour timespan.

index=webserver sourcetype=web_logs  loglevel=error  | stats count by user | where count > 10 

let's say if i schedule this alert at @8am to run every hour, how does the hourly cycle works to fire an email alert..?

If count is > 10 @9:30am, will i get notified via email alert @9:30 or 10am..?

0 Karma


hi mcnamara,

using what operating system?
if you use Windows, try to change and use Linux because Linux includes a default mail management service.

and if it not work is that the condition for triggering the alert has not been met. trying to change the condition to see if you have emails in return before giving your starting condition.

0 Karma


If you schedule it every 1 hour , the search will run only at every hour. So if you schedule at just before 8am, it will execute at 8 am,then 9 am,then 10 am and so on. So at the time of execution(hour) if the condition satisfies, it sends alert. If you want to check if any error has happened after the last schedule, then your search should look from earliest=-1h latest=now to include all events for last one hours.

Hope I could explain!

Happy Splunking!
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...