Real time alerts are not triggering even though results are present in search result.

[saibal6]

I have tested with my real-time alert mail notification with few results. It is working properly and always gave me the exact and proper result what I wanted.

But we I set all my 52 real-time mail alerts notification with the same settings what I have previously tested, after that day I didn't get any mail notification for any alerts but the real time errors are present in search result, it's showing me in Splunk whenever I run the search result but it didn't inform me by mail alerts.

My real time mail alert configuration :
Enabled : Yes. Disable
App : search
Permissions : Private. Owned by admin. Edit
Alert Type : Real-time. Edit
Trigger Condition :
Trigger alert when : Number of Results is > 0 in 6 hours. Edit
Trigger : Once
Throttle : Checked
Suppress triggering for : 24 Hours.

Can anyone help me on this matter? Please let me know if you need more information on this matter.
Please attach the useful link if you have.

[somesoni2]

Running 53 realtime searches could be an overkill (realtime alerts never dies, keep occupying system resources, thus degrading overall system performance). I would suggest rather using a regular historical search, may be running very frequently, say every 5 min or so.