Alerting
Highlighted

alert not triggering

Contributor

Hi I was creating sample alert on index=_internal|stats count by host for last 15min
alert to be triggered on custom condition-

search count > 0

But I am unable to see any alert triggered.
Is there anything I am doing wrong?

Trigger Action-Add to triggered alerts

Labels (1)
0 Karma
Highlighted

Re: alert not triggering

SplunkTrust
SplunkTrust

Are you looking at the Activity->Triggered Alerts page?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: alert not triggering

Contributor

Yes I am looking at Triggered alert Page.

0 Karma
Highlighted

Re: alert not triggering

Super Champion

Just to verify - the alert is enabled? When you run that search over 15 minutes, you get data? (I'd hope so since it's _internal)

Did you check the _internal scheduler logs to see if there was any error for this search? Skips or anything

0 Karma
Highlighted

Re: alert not triggering

Contributor

@cmerriman, I did verify and it is enable and returing data. I did try on other index as well but it seems alert trigger condition is not working. any idea?
same is happening on my production splunk server as well.

0 Karma