Hi @Rakeshar4u  , I've included a link to the dashboard in the body of the alert email, but it appears as plain text rather than a clickable hyperlink. I also tried using <href>, but it still shows as plain text. Here's my alert configuration: My Splunk version is 9.2.1. Any insights would be appreciated.   ... View more

Now you can Accept ! ... View more

Say you only kept 1 month of history (that's how long the expiration was). The time frame would only ever need to be one month, though you could just put all time, if you wanted. You could use the |history command or a |rest Command to get a list of sid and then the |map command with the |loadjob command to loop through all of the sid that were pulled in and bring the data back for all of them. ... View more

You need to make sure that the TTL ("Time To Live") of your scheduled search is at least as long as the periodicity of the search. If your search runs every day than the search's TTL should be at least 60*60*24 or greater. If not, you will get this error. You can check TTL like this: |rest/servicesNS/-/-/saved/searches | fields dispatch.ttl title eai:acl.app description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule https://www.splunk.com/blog/2012/09/12/how-long-does-my-search-live-default-search-ttl/ ... View more

Yes this is the solution ... View more

The only thing that I can think of is that your events are expiring between when the alert hits and when you double-check. This should tell you what the oldest event still in the index is. It should be weeks, if not months old but maybe it is hours or days old. |metadata type=sourcetypes | search sourcetype=log4net ... View more

@sonia , i have converted my comment to answer. Please accept if this helped. ... View more

See Getting Data In at http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/WhatSplunkcanmonitor ... View more

Ideally, everything would be set to the same time zone but not necessary so long as you tell Splunk what timezone each host, source, or sourcetype is in. You can adjust the time zone settings for that host/source/sourcetype by putting a props.conf on the HF to tell Splunk what timezone that sourcetype is in: [bluecoat_G] TZ = UTC ... View more

I have done this but I have no results. Does this app works? ... View more