Alerting

alert not triggering

ips_mandar
Builder

Hi I was creating sample alert on index=_internal|stats count by host for last 15min
alert to be triggered on custom condition-

search count > 0

But I am unable to see any alert triggered.
Is there anything I am doing wrong?

Trigger Action-Add to triggered alerts

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you looking at the Activity->Triggered Alerts page?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ips_mandar
Builder

Yes I am looking at Triggered alert Page.

0 Karma

cmerriman
Super Champion

Just to verify - the alert is enabled? When you run that search over 15 minutes, you get data? (I'd hope so since it's _internal)

Did you check the _internal scheduler logs to see if there was any error for this search? Skips or anything

0 Karma

ips_mandar
Builder

@cmerriman, I did verify and it is enable and returing data. I did try on other index as well but it seems alert trigger condition is not working. any idea?
same is happening on my production splunk server as well.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...