Alerting

alert not triggering

ips_mandar
Builder

Hi I was creating sample alert on index=_internal|stats count by host for last 15min
alert to be triggered on custom condition-

search count > 0

But I am unable to see any alert triggered.
Is there anything I am doing wrong?

Trigger Action-Add to triggered alerts

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you looking at the Activity->Triggered Alerts page?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ips_mandar
Builder

Yes I am looking at Triggered alert Page.

0 Karma

cmerriman
Super Champion

Just to verify - the alert is enabled? When you run that search over 15 minutes, you get data? (I'd hope so since it's _internal)

Did you check the _internal scheduler logs to see if there was any error for this search? Skips or anything

0 Karma

ips_mandar
Builder

@cmerriman, I did verify and it is enable and returing data. I did try on other index as well but it seems alert trigger condition is not working. any idea?
same is happening on my production splunk server as well.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...