My search is:
index=soma source="alarms.txt" StatusID=* |eval Alarm=if(StatusID=0,"Critical","No") | table DateTime EventCode StatusID Message Alarm
The alert runs every minute (cron * * * * *)
and my custom trigger is
There are no fired events for this alert
If I run the search |where Alarm="No" there are 94 events matching that
What am I doing wrong?
When you say
cron *, what is your exact cron expression? I don't believe a single
* is a valid expression, so I want to make sure the issue isn't simply that your search isn't running when you think it should be.
What is the time window being monitored for this search that's running every minute? In my experience, if you're running a search every minute (and presumably looking at data logged in the previous minute), the delays of ingestion may prevent you from seeing anything at all.
Got it. So how about changing the approach. I'd suggest changing your search to this:
index=soma source="alarms.txt" StatusID=* | eval Alarm=if(StatusID=0,"Critical","No") | table DateTime EventCode StatusID Message Alarm | search Alarm="No"
And set the trigger to be
Number of Results, with
is greater than set to 0. Will that achieve what you're trying to do?
What type of license do you have? Is there any chance your evaluation has expired? If you're in "Free" status, alerts won't fire.
If that's not the issue, check your Alert configuration. Ensure that under "Add Actions", you've selected "Add to Triggered Alerts".
And if you want one alert for each result, look at the "Trigger" line under "Trigger Conditions". There are two options: "Once" and "For each result". If you want one alert per result, select "For each result".
Then we're on the right track! Under "Trigger Actions", select "Add Actions" and choose "Send email". You'll need to enter your email address in the
To field and then save it again.
Have you used this Splunk instance to send any other emails? If not, you'll need to follow the steps on this guide to configure communication between Splunk and your mail server: