Splunk Enterprise Security
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

How we can debug reason="Could not get next runtime in corrrelation search to raise an alerts ?

AL3Z
Builder
‎07-17-2023 02:01 AM

Hi,
My cs is not raising an alerts, when I search index=_internal sourcetype=scheduler "xyz- CS" log_level=INFO

07-14-2023 12:50:00.552 +0000 INFO SavedSplunker - savedsearch_id="nobody;SplunkEnterpriseSecuritySuite;Audit - CP - PDM Uploads Non Colgate instances - Rule", search_type="scheduled", user="abc", app="SplunkEnterpriseSecuritySuite", savedsearch_name="xyz- CS - Rule", priority=default, status=continued, reason="Could not get next runtime", scheduled_time=0, window_time=-1

Labels (1)
Labels
0 Karma
Reply
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Take the Survey
Register for .conf25!
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...