Alerting

Scheduled Real-time AlertsTerminating

marksnelling
Communicator

I have a number of real-time alerts scheduled that prior to upgrading to Splunk 6.1 would run continuously. Since the upgrade these jobs now stop alerting even though the jobs are visible in the Activity/Jobs window and are in status "Running 100%".

To get the jobs to start alerting again I have to either delete and recreate them.

Is this a known issue or have I missed a breaking change somewhere in the upgrade?

1 Solution

piebob
Splunk Employee
Splunk Employee

this is appears to be a known issue in 6.1.1:
"After upgrading to 6.1 or 6.1.1, real-time searches (per-result or rolling window) may stop triggering alerts for matching events after running for more than 1 hour. Typically, this is noticed when these searches fail to trigger actions such as sending an email. (SPL-84357)"

http://docs.splunk.com/Documentation/Splunk/6.1.1/ReleaseNotes/KnownIssues

View solution in original post

piebob
Splunk Employee
Splunk Employee

this is appears to be a known issue in 6.1.1:
"After upgrading to 6.1 or 6.1.1, real-time searches (per-result or rolling window) may stop triggering alerts for matching events after running for more than 1 hour. Typically, this is noticed when these searches fail to trigger actions such as sending an email. (SPL-84357)"

http://docs.splunk.com/Documentation/Splunk/6.1.1/ReleaseNotes/KnownIssues

rainhailrob
Path Finder

I've noticed the same problem. We just upgraded from 6.03 to 6.1.1. We have 7 realtime jobs so I wouldn't think that would overload the system.

0 Karma
Get Updates on the Splunk Community!

New Case Study: How LSU’s Student-Powered SOCs and Splunk Are Shaping the Future of ...

Louisiana State University (LSU) is shaping the next generation of cybersecurity professionals through its ...

Splunk and Fraud

Join us on November 13 at 11 am PT / 2 pm ET!Join us for an insightful webinar where we delve into the ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...