Splunk notification Issues

[sreejithpoothu]

Hi,

I have a scheduled search for ERROR from particular log which runs every hour and if there is any error will send alert through mail.But in some times we are getting mail only after 3 or 4 hours when error happens.If an error happens on 1:00am, we are getting notification at 5 am not at 2:00am as per the schedule.I dont have any clue how to debug this.Please help?

Regards
Sreejith.A

[sreejithpoothu]

We didnt see any error from logs.The issue is that our forwader is on UTC and indexer is on EST.When error happens on 01:00UTC ,splunk sends mail at 01:00 EST.Is ther any way we can fix this?

[jbsplunk · Accepted solution]

You can use the instructions here to troubleshoot what is happening:

http://splunk-base.splunk.com/answers/32498/how-to-troubleshoot-splunk-email-notification