Splunk Search

Splunk sending invalid Email Alerts


I am running a query to alert me if the sum of a particular property < 400000. I get alert most times saying the count < 400000. I go and run the query manually for that specific time describred in alert email.. I see that the count is well over 400000. What am I missing here?

index=app host="aws-service-ip*" sourcetype="aws-fht-service-transactions" SVCPushCounter earliest="08/07/2019:19:00:00" latest="08/07/2019:19:30:00"| stats sum(SVCPushCounter) as totalBySvc by Partner| where  (Partner=CVS AND totalBySvc<4000000) )
0 Karma


You may be getting events arriving later into the instance, what could explain the variation in numbers you;re seeing

Check the _indextime field in those events to verify that

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...