Splunk Search

Why aren't alerts triggering in my search on Splunk 8?

guo_dc
Explorer

I created an alert w/ a basic search:

index=_internal | stats count          
Cron Expression:     */1 * * * *
Alert condition  choise customer, Trigger Conditions:    search count>0  
Trigger Actions  is Add to Triggered Alerts.

But no alert messages are showing in the Trigger alerts page.
I'm testing w/ Splunk versions 8.0.4. and 8.0.2.
The same alert configration is normal in Splunk 7.

0 Karma
1 Solution

guo_dc
Explorer

Question solved. Cause alert.condition item of alert configuration file savesearch.conf have wrong Greater than escape.
For example: normal: alert_condition = search data_count > 0
splunk 8 : alert_condition = search count > 0
Testing splunk version is 8.0.4, Suggestion next version fix bug.

View solution in original post

0 Karma

guo_dc
Explorer

Question solved. Cause alert.condition item of alert configuration file savesearch.conf have wrong Greater than escape.
For example: normal: alert_condition = search data_count > 0
splunk 8 : alert_condition = search count > 0
Testing splunk version is 8.0.4, Suggestion next version fix bug.

0 Karma

dindu
Contributor

Hi,

Could you give us more details?

Check whether the search is producing any results.
Also, include the time window in the search as below.

     index="your_index" sourcetype="your_st" earliest=-1h@h latest=@h

I am searching for a window of one hour

0 Karma

guo_dc
Explorer

I modified base search:
index=_internal sourcetype=splunkd earliest=-10m@m latest=@m | stats count as data_count
But also, Alert isn't trigged . In triggered Alerts page don;t appeared.

I check search result in Job manager, Search result is normal.
This fault is the same for linux and windows platform.
When alert condition is number of result, alert trigger is normal.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...