Alerting

Scheduled searches stuck in past

ebs
Communicator

Hi, 

I have two scheduled searches that aren't running anymore and I've no idea why. The cron is correct, when running the search there are results but I'm not receiving any alerts. Checking the next scheduled time today I noticed that the next scheduled search was dated several days in the past.

I've tried adjusting the cron schedule but that didn't work I've also tried disabling and renenabling the search but it hasn't resolved it either.

 

It is Splunk Cloud.

Labels (2)
0 Karma

jodonald
Explorer

please post your cron schedule

0 Karma

ebs
Communicator

I have two searches this is occuring for:

1) */5 * * * *
2) */15 * * * *

Tags (1)
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...