Alerting

Scheduled searches stuck in past?

ebs
Communicator

Hi, 

I have two scheduled searches that aren't running anymore and I've no idea why. The cron is correct, when running the search there are results but I'm not receiving any alerts. Checking the next scheduled time today I noticed that the next scheduled search was dated several days in the past.

I've tried adjusting the cron schedule but that didn't work I've also tried disabling and renenabling the search but it hasn't resolved it either.

 

It is Splunk Cloud.

Labels (2)
0 Karma

cesaccenturefed
Path Finder

We are seeing the same behavior, will update if we figure out a root cause or issue. 

0 Karma

pratibha0610
Explorer

@cesaccenturefed : did you see any solution for this issue?

0 Karma

jodonald
Explorer

please post your cron schedule

0 Karma

ebs
Communicator

I have two searches this is occuring for:

1) */5 * * * *
2) */15 * * * *

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...