Splunk Alert Triggers after 15 minutes of its scheduled time

[AniketD]

Hi All,

I've configured an alert which sends a mail when the count is not less than 1 for a particular feed.

I;ve given the below criteria :

Cron Schedule : 45 21 asterisk asterisk 0 [ So that is runs at 21:45 on every Sunday, I;ve written asterisk as the symbol was not coming in the post ]
Time Range : Earliest [-15m@m] Latest [@m] , so that it checks if the count is not less than 1 at 21:45 for the last 15 minutes

The problem here is that the search triggers at nearly 21:59 , however, the time range picked remains the same [21:30 - 21:45 ] and I get a email at around 10:01

can someone please tell me what is happening and is there anything which I am missing and need to know and understand

[tiagofbmm]

Can you check if you have a Schedule Window on your alert of 15m?

https://docs.splunk.com/Documentation/Splunk/7.0.2/Report/PrioritizescheduledreportsinSplunkWeb#Sche...

[FeatureCreeep]

Have you checked your job in the Activities view? That will tell you what time the job executed and how long it took to complete. One possibility, There are alert options that allow your query to delay when it is ran if the Splunk cluster is busy so maybe you selected one of those options? Another possibility is that the query just took that long to complete. I'm guessing that isn't the case but looking at the job from the Activities view should help you narrow down the possible causes.

[AniketD]

Hi,

Thanks a lot for your response!

Yes, I did went into the activities view and it is from there I came to know that it ran after nearly 15 mins of it scheduled time. The query took about a minute to run.

To answer your 2nd question, no I did not select any such criteria/options to delay the alert.

One thing I observed even for other alerts is that the delay is about 15 min.