Alerting

Ambiguous behavior of Splunk Alert

sarvesh_11
Communicator

I am getting alert in splunk, when i click the hyperlink "View Result in Splunk",
it is giving me the same what is there in the mail body.
But when i again run the same code for same time window, there is nothing, i.e just hit , the results disappear?
Also, they are false alerts. the correct output is shown when we are rerunning the query.

Now this is frightening, and looses confidence on Splunk. Though its not happening in repetitive manner, its unusual.
My code is :

| makeresults
| eval Field1="1,2,3,4,5"
| eval Field1=split(Field1,",")
| mvexpand Field1
| join type=left Field1
[ search index=x source="abc"(my source is database)
....]

and the code goes onn.
@gordo32 i have seen your inputs on this https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html. Do you think the "search" will also resolve my thing?

0 Karma

jawaharas
Motivator

Are you using relative time (say last 15 min, last 1 hour etc.,) for your search?

0 Karma

sarvesh_11
Communicator

@jawaharas Yes i am using Last 15minutes as time window and cron schedule of every 5minutes.

0 Karma

jawaharas
Motivator

Is your issue replicable when using absolute time range (from 'timerange' picker, select 'Date & Time Range) instead of relative time (last 15 min) ?

Also, can you share your full Splunk query?

0 Karma

sarvesh_11
Communicator

yes, it is replicable!
I am sorry, i cannot share the whole query.
I found something intereting in: https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html

Using "search" in alert was creating a problem, thankfully i get rid of it 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...