Reporting

Missing some Real-Time emails

jat75
Explorer

Recently a real-time search and email alert has failed to fire consistently. I am fairly certain that this used to work for every event. Now for some real-time triggered events, no email is getting sent. I compare the splunk search to the emails I'm getting and I am definitely missing emails. The search string has not changed. Perhaps it's a performance issue? (I am using a JOIN but my splunk admin tells me the system has plenty of resources). I am mostly curious about how to troubleshoot something like this. Thank you.

Tags (2)
0 Karma

jat75
Explorer

Update: I created the same real time alert without using a join (however I do need a join) and I am getting more emails for that alert than the one with the join. Could this be a timing or resource thing?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...