Alerting

Why is our Splunk alert not showing results for "today"?

agentguerry
Path Finder

I have set this alert up, which i want to show me the results of "today"

index=_internal source="*license_usage.lo*" type=Usage pool="Linux Pool"| stats sum(b) as bytes | eval gb=bytes/1024/1024/1024

but when it sends me an email, the results are not correct. I can click the link to "view in splunk", and at that point the time range is set as "date time range", and not as "today".

How can i set this to always be "today" in my search/alert?

Thanks!

Tags (2)
0 Karma

woodcock
Esteemed Legend

What makes you think it is incorrect? Did you look at the actual values in the timepicker? If you do, and you correctly set the search to run for today (you have not shared those details), then you will find that the earliest and latest values inside of Date & Time Range correspond to today for the user that ran the search (the one who owns the saved search), which may or may not be you. It is confusing because it doesn't say today and there is nothing that can be done about that.

0 Karma

agentguerry
Path Finder

the results in my email come incorrect. I can see this difference when i view the license tab in splunk, on the admin gui.

I found that in my actual search that is being used for the alert i can specify.

"earliest=@d|"

0 Karma

woodcock
Esteemed Legend

What are the time parameters in your saved search?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...