Splunk Search

Why aren't alerts triggering in my search on Splunk 8?

guo_dc
Explorer

I created an alert w/ a basic search:

index=_internal | stats count          
Cron Expression:     */1 * * * *
Alert condition  choise customer, Trigger Conditions:    search count>0  
Trigger Actions  is Add to Triggered Alerts.

But no alert messages are showing in the Trigger alerts page.
I'm testing w/ Splunk versions 8.0.4. and 8.0.2.
The same alert configration is normal in Splunk 7.

0 Karma
1 Solution

guo_dc
Explorer

Question solved. Cause alert.condition item of alert configuration file savesearch.conf have wrong Greater than escape.
For example: normal: alert_condition = search data_count > 0
splunk 8 : alert_condition = search count > 0
Testing splunk version is 8.0.4, Suggestion next version fix bug.

View solution in original post

0 Karma

guo_dc
Explorer

Question solved. Cause alert.condition item of alert configuration file savesearch.conf have wrong Greater than escape.
For example: normal: alert_condition = search data_count > 0
splunk 8 : alert_condition = search count > 0
Testing splunk version is 8.0.4, Suggestion next version fix bug.

0 Karma

dindu
Contributor

Hi,

Could you give us more details?

Check whether the search is producing any results.
Also, include the time window in the search as below.

     index="your_index" sourcetype="your_st" earliest=-1h@h latest=@h

I am searching for a window of one hour

0 Karma

guo_dc
Explorer

I modified base search:
index=_internal sourcetype=splunkd earliest=-10m@m latest=@m | stats count as data_count
But also, Alert isn't trigged . In triggered Alerts page don;t appeared.

I check search result in Job manager, Search result is normal.
This fault is the same for linux and windows platform.
When alert condition is number of result, alert trigger is normal.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...