@burakatabay  Initial debug is to check app level permissions for this datamodel? Does this datamodel is shared across all the apps? ... View more

@uagraw01  Alerts will be triggered if  scheduled job runs without errors.  specified alert condition met Its always better to run the search manually to check for syntax, run time errors. and also check for alert conditions. I am still wondering how the user without schedule_search capability was able to schedule in the first place.  You can assign the alert to you (reassign knowledge objects) so that it runs with your capabilities. Hope this helps.   ... View more

@Reethika  Is this dispatch directory disk space warning occurring across all the search heads? If it's on one node you can move/delete them since they are available on the other SH nodes. Its better to delete the older artifacts first. https://docs.splunk.com/Documentation/Splunk/8.0.4/Search/Dispatchdirectoryandsearchartifacts#Clean_up_the_dispatch_directory_based_on_the_age_of_directories Hope this helps ... View more

@stonelzhangh  Both are same. Datamodel does not alter the _time of the event.  ... View more

@UMDTERPS  Do you have "email" field in your base search? You should have email field in your query. If the field name is not email, Please change the token on map search command accordingly. The output for this search query will be zero.  The syntax is not correct in your query. Its not a sub search. I guess I was not clear earlier. Try this  | inputlookup scan_due_date.csv | eval date = strptime('Scan Date', "%d-%b-%Y") | eval duedate = if(isnull(date) OR date="", "Unspecified", date) | eval status=case(duedate >= now(),"Not Expired",duedate="Unspecified",duedate true(),"Overdue") | search status=Unpecified OR status=Overdue | map search="| sendemail to="$email$" subject= "Alert - Shame on you! Your System Scan is Either Overdue or Date Unspecified" from="bob@mail.com" message="Shame!" "   Hope this helps. ... View more

@andrewtrobec  Did you check search.log for any errors? ... View more

@vumanhtai  Couple of Q's whats your SPL command to search the datamodel? Are you using summariesonly=t in the tstats? Does the source index has the data for mentioned time period? The datamodel Status is 92.33% means its not yet completed building the summaries. If you are using summariesonly=t, try removing that attribute and see if it returns all the data.     ... View more

@irishmanjb  This should work index="blah" sourcetype="blah:csv" [ | inputlookup SerialNumber | table filedname | format ] The field name in the lookup should match with the field name in index. If its not the same use rename fieldname as fieldname1 (fieldname1 is in the index) If the field name has a white space like "Serial Number", wrap it in quotes like "filed name" ... View more

@mdepuy  It depends on your current configuration. In general, UF & Indexers have their own certs. So, you need to figure out which cert is expired? Assuming both are expired, you can follow one of the below mentioned configurations 1) You can request one cert for all UFs & one for all indexers (with the same sslCommonName).  2) You can request one cert for all UFs & one for each indexer (with unique sslCommonName).  Please refer splunk documentation for more details. https://docs.splunk.com/Documentation/Splunk/8.0.4/Security/ConfigureSplunkforwardingtousesignedcertificates ... View more

@UMDTERPS  use map along with sendemail command to send alerts. base search generating results | map search="...| sendemail to="$email$"" ... View more

@pkumar2  You can add eval condition to ingest the accepted event to the stats and later filter out. sample Query: eval accept = if(like(_raw, "%Mura%Map%Accepted%"), "Yes","No") | stats max(VAL) AS max , min(VAL) AS min values(accept) as accept by Laser, TILE,host | where accept="No" Hope this helps!!! ... View more

@adamfrisbee  In the first SPL there is no field named "status=200". So it fails. | stats count(status=200) AS Success The second one has eval nested in, which is equivalent to create a new filed with status=200. So now the stats count the new field. | stats count(eval(status=200)) AS success   Hope this helps ... View more

@martinnepolean  I assume yours is not a shcluster set up. Are you able to identify the search that generated this collection minemeldfeeds_lookup? You can re-run this search for longer times to build the collection again.    ... View more

@VijaySrrie  The query looks good. what about the settings?  I assume you are using access_timestamp as rising column. Did you set up the initial check point value for this field ?  ... View more

@Reethika  Did you find these in dispatch directory (/opt/splunk/var/run/splunk/dispatch)? These are search artifacts. whenever you run search (either saved OR adhoc) it created these artifacts on the same node.  when the job expires these artifacts gets deleted. ... View more

@shashank_24  add where command to SPL to filter out the threshold value. index="myindex" sourcetype=access_combined_wcookie | timechart span=1h count by host | where count > (your threshold value) run the search to validate the results and saveas -> alert. You should give name, schedule time etc to save the alert  ... View more

@VijaySrrie  Can you provide more details?  ... View more

@diptij  If its with the data volume, try to increase the throughput to 512kbps OR more (default is 256kbps) for debug purpose and see if this resolves. we went upto 4096kbps for one of the use case. Is there any errors in the log messages? ... View more

@mathiasy123  Did the search run? what is the schedule? From the image shared, It looks like the alert has been scheduled every monday 6am.  ... View more

@Sam1  you can use filed= value1 OR filed=value2 and so on in the search. You can always configure the alert to send an email for each result OR group of results.   ... View more