Why are email alerts not getting sent?

New Member

New to Splunk

I have a search index="data_collection"

They have it set up to email them.

When you are looking at search, you see tons of results ... but no email is ever sent.

alert type
real time
then number of results
greater then 3
in 1 minute
trigger once
throttle every 120 seconds

they want to get a email every time there are more then X number of data entries

0 Karma

New Member

email has been setup, other alerts work correctly

on the number of results, when you watch it realtime in search, you get 30 a minute sometimes

0 Karma

Splunk Employee
Splunk Employee

It is possible that email notification settings still need to be configured. This should be done before email alert notifications can be sent. You can find more details here:

Based on your trigger conditions, it is also not clear if the number of results that occur in one minute is enough to cause the alert to trigger.

For more details, see


Hope this helps!


Do you get emails from other alerts?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...