Other Usage

Why is Splunk email triggering twice?

mm185429
New Member

Hi,

I have created a splunk email and it seems to be triggering it twice. Below the query and alert configuration.

query:
index="liquidity" AND cf_space_name="pvs-ad00008034" AND (msg.Extended_Fields.ValueAmount = "0" OR msg.Extended_Fields.ValueAmount = "NULL" OR msg.Results.Message="EWI Load process is completed*") | table _time, msg.Extended_Fields.DataSource, msg.Extended_Fields.ValueAmount, msg.Results.Message | sort by _time | rename msg.Extended_Fields.ValueAmount as ValueAmount | rename msg.Results.Message as Message | rename msg.Extended_Fields.DataSource as DataSource

 

trigger condition:

search Message = "EWI Load process is completed*" | stats count as Total | search Total > 0alert config pic 1.PNGInkedalert config pic2.jpg

Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

How do you know that the alert is triggered twice? Because you get double email? Do all the recipients get double email or is it just you? Are you sure it's not that there are some redirections in your email system?

0 Karma

mm185429
New Member

@PickleRick The issue is intermittent. The double email is sent to all the recipients. There is no redirection from the email system as far as I know.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Ok. And it's the same email - from the same scheduled search run? Not from two separate ones?

Is it a standalone SH or a cluster? Does searching for sendemail.py yields single send per alert or double?

0 Karma

mm185429
New Member

@PickleRick Yes, It is the same email from the same scheduled search run and not from two separate ones.

I'm not sure if it is standalone SH or a cluster since this is managed by another team in my organization. How can I search for sendemail.py?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

To be honest, if it's not "your" environment (I mean you're not administering it), I'd just create a ticket with your splunk admin team because you probably don't have enough permissions to troubleshoot it on your own.

You could try to search for

index=_internal sendemail.py

Around the time that your alert was triggered but typically non-admin users don't have access to internal indexes.

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...