Alerting

alert not triggering

ips_mandar
Builder

Hi I was creating sample alert on index=_internal|stats count by host for last 15min
alert to be triggered on custom condition-

search count > 0

But I am unable to see any alert triggered.
Is there anything I am doing wrong?

Trigger Action-Add to triggered alerts

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you looking at the Activity->Triggered Alerts page?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ips_mandar
Builder

Yes I am looking at Triggered alert Page.

0 Karma

cmerriman
Super Champion

Just to verify - the alert is enabled? When you run that search over 15 minutes, you get data? (I'd hope so since it's _internal)

Did you check the _internal scheduler logs to see if there was any error for this search? Skips or anything

0 Karma

ips_mandar
Builder

@cmerriman, I did verify and it is enable and returing data. I did try on other index as well but it seems alert trigger condition is not working. any idea?
same is happening on my production splunk server as well.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...