Alerting

Alert is not getting triggered

bhepi01
New Member

Hi People,

I created a sample app which works with uploaded data in splunk. The data has almost 1700 rows. This data is fixed. I created an alert which is based on triggered condition. The condition is number of results. I added condition in alert is number of results >0 in last one minute. when I do simple search like source="sourcename". Results are returning my 1700 rows.
But alert is not triggering. I don't see anything in alert activity( Triggered alert).
What am I missing here?

Thanks in advance
Bheem

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Few things to check :

  • Are you running the same search as in alert in the search bar with 1 minute time range?
  • Try adding index= in the SPL. It's possible that your search is not searching any index by default.
  • Do you see any entries in the scheduler log about this alert ?

Have a look at http://wiki.splunk.com/Community:TroubleshootingScheduledSearches

Happy Splunking!
0 Karma

bhepi01
New Member

I tried with index= also , I did not see any entries in scheduler log.

PS: I did not understand first point.

Please explain first point and I request to give some other points to debug this problem.

I am tired of this 😞

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Alright!
Select your app
Run your search in the search bar and check if the results are showing up
Save as alert and schedule the alert. Check the scheduler log for your alert

Happy Splunking!
0 Karma

bhepi01
New Member

How much time do I need to select in scheduler alert ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...