Alerting

Splunk scheduler logs missing for all alerts

vrmandadi
Builder

We have alerts running and sending an alert to service now or to mail .We did not get the alerts last saturday and sunday and when I went into internal logs and searched for the saved searches events I dont see any events.Below is the search i used.I can see events before and after the weekend but not on saturday and sunday

index=_internal sourcetype=scheduler saved_searchname= *

Any thoughts or did any one ran into these kind of issue

0 Karma

burwell
SplunkTrust
SplunkTrust

Hello @vrmandadi Can you share the schedule you run the alerts on?

0 Karma

vrmandadi
Builder

There are multiple alerts running at different times.Some run every 5 minutes ,some every 10 mins,some every 15 mins,some every 30 mins ...etc

0 Karma

vrmandadi
Builder

Any one had the same issue?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...