Alerting

Real-time alert conditions

gtorrent
Explorer

I observed an surprising Splunk behaviour creating a real-time alert for the following query:

 index="thirdlane" sourcetype="asterisk_queue_log_*" 
| TRANSACTION callid maxspan=10m startswith(event=ENTERQUEUE)
| SEARCH (event=EXITEMPTY OR event=AGENTDUMP OR event=EXITWITHKEY OR event=EXITWITHTIMEOUT OR event=ABANDON) 
| REX "(?i)\|ENTERQUEUE\|.*?\|(?P<tlfnumber>.+)\|"
| TABLE _time tlfnumber queuename duration

When the alert condition is 'always', the received email contains an unexpected result (tlfnumber='' and duration=0).

Otherwise, when the alert condition is 'if number of events is greater than 0', the received email contains the expected result. But, when I edit the email action, Splunk displays the following message:

Unsupported Alert. 
A real-time alert with a time range of all-time and a condition other than always is not supported. 
It is recommended you change the time range of the alert to something other than Start Time 'rt' Finish Time 'rt' in Settings.

Is this the expected behaviour?
What is the explanation of this behaviour?

0 Karma

gtorrent
Explorer

Additional info: We are running splunk 6.1.2 (build 213098) on a linux machine.

0 Karma

gyslainlatsa
Motivator

hi gtorrent,
for the Real-time alert condition, do not specify the timerange. leave this field empty, The real-time alert specifies when the search runs.

try to following this link: http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Defineper-resultalerts

0 Karma

gtorrent
Explorer

I have not modified the time range values. The time range values are: 'rt'.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...