×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
andy11
Observer
Member since: ‎10-26-2024
‎10-29-2024
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-26-2024
View All

Re: How to trigger an alert if the events are huge...

by in Splunk Search
‎10-27-2024 04:12 AM
‎10-27-2024 04:12 AM
Hi @gcusello , Thanks for your reply. Actually my search is not taking that much time, hardly it takes 4-6 minutes of time to complete the search. But the problem here is the alert is triggering before the search complete, means after 2-3 minutes of the cronjob scheduled time. So only 30-40% of search completed within those alert triggering time and i'm getting alerts everyday. I need a solution that the alert will trigger only after the search complete. So can you please help me what to do in this case? Thanks in advance. ... View more

How to trigger an alert if the events are huge, th...

by in Splunk Search
‎10-26-2024 07:55 PM
‎10-26-2024 07:55 PM
I'm using a query which returns entire day data :       index="index_name" source="source_name"        And this search provides me above 10 millions of huge events. So my requirement is if the data gets reduced below 10m i should receive an alert. But when this alert is triggering then this entire search is not getting completed because it's taking lots of time and before that only the alert triggering every time. So is there any way that i can trigger this alert after the search completed completely. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎10-29-2024 10:08 AM