Alerting

Triggered alert on scheduled search didn't send email.

jveloso
New Member

Greetings!

I have a scheduled rule that runs every closed minute and it matched an event at 1:30:03PM which was supposed to send an email but it hasn't. What could be the cause of this?

example

Any suggestions will be appreciated

Labels (2)
0 Karma

Nisha18789
Builder

Hi @jveloso  did you checked and confirmed that there is no email action fired from Splunk when this alert fired at the mentioned instanc, you can use below query to confirm if there was no matching event for the issue timeframe that would imply email was not sent when the alert fired.

index=_internal sourcetype=scheduler status=success savedsearch_name=<name of your alert> alert_action=email 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...