Alerting

Restarting Splunk triggers all my alerts (and floods my inbox)

Ultra Champion

I have a number of scheduled alerts which have thresholds configured to send me alerts if we see either too many or too few events in a given timeframe. But a restart of my seachhead triggers each of these events to fire (despite, it would seem the threshold not being crossed).

Is there anyway to prevent these alerts firing when restarting spunk, i.e. delay an alert triggering immediatly following startup.

I can't be the only person to find this irritating 🙂

If my comment helps, please give it a thumbs up!
Tags (2)

Ultra Champion

Charles,

Did you ever get a response from your support case? This still plagues us.

If my comment helps, please give it a thumbs up!
0 Karma

Engager

me too.

Did anyone open a support case?

0 Karma

Path Finder

I have a similar problem - we have real time alerts that trip when there is a lack of certain items present. If there is a brief interruption in communication from the search head to indexers, the alert trips.

0 Karma

Explorer

Yes, I opened a case. Actually my issue is that when I edit or disable a realtime search, the search triggers. I suspect the two issues are related. I'll post whatever solution I get from support.

0 Karma

Explorer

I have also experienced this issue. I guess it's time to open a support case...

0 Karma

Ultra Champion

This is still very much a problem in our estate.

Can anyone else confirm that they see the same behaviour?

If my comment helps, please give it a thumbs up!
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!