Alerting

Why is our Splunk alert not showing results for "today"?

agentguerry
Path Finder

I have set this alert up, which i want to show me the results of "today"

index=_internal source="*license_usage.lo*" type=Usage pool="Linux Pool"| stats sum(b) as bytes | eval gb=bytes/1024/1024/1024

but when it sends me an email, the results are not correct. I can click the link to "view in splunk", and at that point the time range is set as "date time range", and not as "today".

How can i set this to always be "today" in my search/alert?

Thanks!

Tags (2)
0 Karma

woodcock
Esteemed Legend

What makes you think it is incorrect? Did you look at the actual values in the timepicker? If you do, and you correctly set the search to run for today (you have not shared those details), then you will find that the earliest and latest values inside of Date & Time Range correspond to today for the user that ran the search (the one who owns the saved search), which may or may not be you. It is confusing because it doesn't say today and there is nothing that can be done about that.

0 Karma

agentguerry
Path Finder

the results in my email come incorrect. I can see this difference when i view the license tab in splunk, on the admin gui.

I found that in my actual search that is being used for the alert i can specify.

"earliest=@d|"

0 Karma

woodcock
Esteemed Legend

What are the time parameters in your saved search?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...