Splunk sending invalid Email Alerts

rmuraly · ‎07-08-2019

I am running a query to alert me if the sum of a particular property < 400000. I get alert most times saying the count < 400000. I go and run the query manually for that specific time describred in alert email.. I see that the count is well over 400000. What am I missing here?

index=app host="aws-service-ip*" sourcetype="aws-fht-service-transactions" SVCPushCounter earliest="08/07/2019:19:00:00" latest="08/07/2019:19:30:00"| stats sum(SVCPushCounter) as totalBySvc by Partner| where  (Partner=CVS AND totalBySvc<4000000) )

tiagofbmm · ‎07-09-2019

You may be getting events arriving later into the instance, what could explain the variation in numbers you;re seeing

Check the _indextime field in those events to verify that

Splunk sending invalid Email Alerts

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

Splunk sending invalid Email Alerts

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience