Triggered alert on scheduled search didn't send email.

New Member


I have a scheduled rule that runs every closed minute and it matched an event at 1:30:03PM which was supposed to send an email but it hasn't. What could be the cause of this?


Any suggestions will be appreciated

Labels (2)
0 Karma


Hi @jveloso  did you checked and confirmed that there is no email action fired from Splunk when this alert fired at the mentioned instanc, you can use below query to confirm if there was no matching event for the issue timeframe that would imply email was not sent when the alert fired.

index=_internal sourcetype=scheduler status=success savedsearch_name=<name of your alert> alert_action=email 

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...