Splunk Search

Alerts not Finalizing- Is there a way to find out why it's getting stuck?

alucarddjin
Path Finder

I've got an issue with a scheduled alert that keeps going to finalizing but never stops (if this happens on the weekend it will "finalize" all weekend until I kill it on Monday).

Is there a way to find out why it's getting stuck, or to set a finalizing time limit so it just stops after n seconds regardless of state?

I've already set the dispatch.max_time but that doesn't appear to effect the finalizing duration.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...