Splunk Search

not all real-time-alert emails are being sent

michal_centralw
Explorer

Hi,

I have very odd situation, all but one realtime alert are working fine. One alert which flags up the 404s works for a few minutes after splunk restart and then it stops sending emails. Neither python.log nor scheduler.log shows any sort of errors. It looks like an alert would never be triggered, however when I open the search result i can observer that search actually works.

0 Karma

alterdego
Path Finder

This doesn't seem to be the same issue you are having but I had a similar problem after upgrading to 6.1.1 where some alerts wouldn't fire. In my case it also seemed to be related to the account that owned the search.

My situation seemed to be known issue SPL-84357. The workaround was to add a session timeout line to server.conf (sessionTimeout = 30d). After making the change and restarting the alerts fired as expected.

I've included the links I found most helpful here:

http://answers.splunk.com/answers/137421/why-are-my-real-time-alerting-searches-no-longer-sending-em...

http://docs.splunk.com/Documentation/Splunk/6.1.1/ReleaseNotes/Knownissues

Hope that helps.

michal_centralw
Explorer

Unfortunately this didn't help, emails are still not being sent after some time

0 Karma

michal_centralw
Explorer

hi alterdego, I will try it out now, and maybe this is somehow related!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!