Splunk Search

not all real-time-alert emails are being sent



I have very odd situation, all but one realtime alert are working fine. One alert which flags up the 404s works for a few minutes after splunk restart and then it stops sending emails. Neither python.log nor scheduler.log shows any sort of errors. It looks like an alert would never be triggered, however when I open the search result i can observer that search actually works.

0 Karma

Path Finder

This doesn't seem to be the same issue you are having but I had a similar problem after upgrading to 6.1.1 where some alerts wouldn't fire. In my case it also seemed to be related to the account that owned the search.

My situation seemed to be known issue SPL-84357. The workaround was to add a session timeout line to server.conf (sessionTimeout = 30d). After making the change and restarting the alerts fired as expected.

I've included the links I found most helpful here:



Hope that helps.


Unfortunately this didn't help, emails are still not being sent after some time

0 Karma


hi alterdego, I will try it out now, and maybe this is somehow related!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...