All Apps and Add-ons

alert not triggering

Praz_123
Path Finder

I have alert configure in Splunk and alert search query is generating the events but am not receiving any email alerts  other alerts are working fine in my environment . I have selected "send email" in alert action In splunk . 

Labels (2)
0 Karma

Praz_123
Path Finder

@inventsekar 

1) is it a production environment? yes

2) the SMTP details are configured or not yet?yes

3) do you have other alerts which are sending emails?yes

4) on the search bar, when you run the sendemail command, do you get the emails?yes

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Praz_123 

1) the alert search query.. can you pls copy paste that here (remove the ip address, hostnames, sensitive details, etc)

2) the alert trigger conditions... results equal to 0 or greater or lesser than.. screenshot.. can you share it with us, thanks

 

0 Karma

Praz_123
Path Finder

@inventsekar  
search query :-

index="abc" sourcetype="abcd_logs" host="AbdP" Error OR Exception OR iisnode OR ERROR

 the alert trigger conditions...  is greater than 0,  Expires = 24 hours. Cron : */5 * * * * , Time Range : Last 30 minutes.

PS: can't share the screenshot here. 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Praz_123 

all looks good so far.. 

the alert trigger actions.. did you enabled the email notification and provided your email id?

0 Karma

Praz_123
Path Finder

@inventsekar 

yes, when we put result = 0 it shows the result .
But if we put greater than =0 it doesn't shows the result .

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Praz_123 

Pls provide us more details..

1) is it a production environment? 

2) the SMTP details are configured or not yet?

3) do you have other alerts which are sending emails?

4) on the search bar, when you run the sendemail command, do you get the emails?

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...