Hi I was creating sample alert on
index=_internal|stats count by host for last 15min
alert to be triggered on custom condition-
search count > 0
But I am unable to see any alert triggered.
Is there anything I am doing wrong?
Trigger Action-Add to triggered alerts
Just to verify - the alert is enabled? When you run that search over 15 minutes, you get data? (I'd hope so since it's _internal)
Did you check the _internal scheduler logs to see if there was any error for this search? Skips or anything
@cmerriman, I did verify and it is enable and returing data. I did try on other index as well but it seems alert trigger condition is not working. any idea?
same is happening on my production splunk server as well.