Reporting

Splunk notification Issues

sreejithpoothu
New Member

Hi,

I have a scheduled search for ERROR from particular log which runs every hour and if there is any error will send alert through mail.But in some times we are getting mail only after 3 or 4 hours when error happens.If an error happens on 1:00am, we are getting notification at 5 am not at 2:00am as per the schedule.I dont have any clue how to debug this.Please help?

Regards
Sreejith.A

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

sreejithpoothu
New Member

We didnt see any error from logs.The issue is that our forwader is on UTC and indexer is on EST.When error happens on 01:00UTC ,splunk sends mail at 01:00 EST.Is ther any way we can fix this?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

You can use the instructions here to troubleshoot what is happening:

http://splunk-base.splunk.com/answers/32498/how-to-troubleshoot-splunk-email-notification

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...