Alerting

alert not triggering

ips_mandar
Builder

Hi I was creating sample alert on index=_internal|stats count by host for last 15min
alert to be triggered on custom condition-

search count > 0

But I am unable to see any alert triggered.
Is there anything I am doing wrong?

Trigger Action-Add to triggered alerts

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you looking at the Activity->Triggered Alerts page?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ips_mandar
Builder

Yes I am looking at Triggered alert Page.

0 Karma

cmerriman
Super Champion

Just to verify - the alert is enabled? When you run that search over 15 minutes, you get data? (I'd hope so since it's _internal)

Did you check the _internal scheduler logs to see if there was any error for this search? Skips or anything

0 Karma

ips_mandar
Builder

@cmerriman, I did verify and it is enable and returing data. I did try on other index as well but it seems alert trigger condition is not working. any idea?
same is happening on my production splunk server as well.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...