Next Scheduled Time for all alerts is showing none

[nnimbe1]

Hi All,

One of our team mate, disabled and enabled some apps on SH, post which we are seeing Next Scheduled Time for all alerts is showing none for all the alerts in SH, in alert setting we can see that cron job is scheduled, due to which none of the alerts are triggering from our SH, can anyone suggest which setting or parameter to be checked , below screenshot FYR

[gabriel_vasseur]

Long shot, but it might be worth checking who owns the alerts.

"settings" (in the top right corner) > "Searches, reports, and alerts" > search for your alerts and check the owner

If for whatever reason the owner isn't a user that exists, the scheduler will not try to schedule it.

[venkatasri]

Hi @nnimbe1 

Goto the app in CLI and locate savedsearches.conf and find-out cron_schedule is set and is valid. Same you can find in Edit mode of alert in UI that you pasted.

Can you issue this SPL and find out if there are errors and what is the status of these alerts.

index=_internal source=*scheduler.log <your_alert_name>

--

An upvote would be appreciated if this reply helps!