Hi everyone. I have the following issue using Splunk Enterprise (v. 9.2.0). I developed a script to send a CSV dataset to Splunk using a data input (I know it's possible to upload CSV directly, but I have specific requirements). Then, I defined a Real-Time alert having the following settings: That is, "trigger an alert everytime, during a minute, the provided query returns at least 1 result" (in the actual situation the threshold will be 600 and not 1, but this is a test). When I enable the alert and start sending data, I see this window upadting in real time: But no alert is triggered, why?
... View more