Reporting

Splunk notification Issues

sreejithpoothu
New Member

Hi,

I have a scheduled search for ERROR from particular log which runs every hour and if there is any error will send alert through mail.But in some times we are getting mail only after 3 or 4 hours when error happens.If an error happens on 1:00am, we are getting notification at 5 am not at 2:00am as per the schedule.I dont have any clue how to debug this.Please help?

Regards
Sreejith.A

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

sreejithpoothu
New Member

We didnt see any error from logs.The issue is that our forwader is on UTC and indexer is on EST.When error happens on 01:00UTC ,splunk sends mail at 01:00 EST.Is ther any way we can fix this?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

You can use the instructions here to troubleshoot what is happening:

http://splunk-base.splunk.com/answers/32498/how-to-troubleshoot-splunk-email-notification

Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...