Splunk Search

not all real-time-alert emails are being sent



I have very odd situation, all but one realtime alert are working fine. One alert which flags up the 404s works for a few minutes after splunk restart and then it stops sending emails. Neither python.log nor scheduler.log shows any sort of errors. It looks like an alert would never be triggered, however when I open the search result i can observer that search actually works.

0 Karma

Path Finder

This doesn't seem to be the same issue you are having but I had a similar problem after upgrading to 6.1.1 where some alerts wouldn't fire. In my case it also seemed to be related to the account that owned the search.

My situation seemed to be known issue SPL-84357. The workaround was to add a session timeout line to server.conf (sessionTimeout = 30d). After making the change and restarting the alerts fired as expected.

I've included the links I found most helpful here:



Hope that helps.


Unfortunately this didn't help, emails are still not being sent after some time

0 Karma


hi alterdego, I will try it out now, and maybe this is somehow related!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...