Alerting

Why does my alert run for an "All time" time range, when I have set it for "Relative - 2 hours ago"?

arunsubram
Explorer

Hi,
I have set up a Alert as such

index=rest because the offer is shutoff. partnerId="*" host="*-prd-rst*"  | stats  count by partnerId,offerId  | lookup  partneridlookup partnerId OUTPUT RetailerName |sort count DESC

In the timeframe, I have chosen "Relative - 2 hours Ago". The alert is set on a cron as 0 */2 * * * [to run every two hours].

For some reason, every time this Alert is triggered, timeframe run is for "All time". It does on run for the 2 hours window provided.
The issue seems to be only with this Alert. My other Alerts work fine. Any pointers would be helpful.

0 Karma
1 Solution

niketn
Legend

Relative Timeframe for previous 2 hours should work as selected. However if you want to force the time window on your search you can add the same to your base search as well...

<Your Base Search> earliest=-2h latest=now | <Your remaining Search>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

mattymo
Splunk Employee
Splunk Employee

The alert should be using the timeframe you set when you created the alert.

Navigate to the alerts section of the app you are working in, or go to Settings > Searches, Reports, Alerts and open your alert for editing.

Please share your settings here:

alt text

As you can see my alert triggers every 5 minutes and looks back 5 minutes.

Let's make sure you have vaild time selectors in the configuration of the alert.

- MattyMo
0 Karma

niketn
Legend

Relative Timeframe for previous 2 hours should work as selected. However if you want to force the time window on your search you can add the same to your base search as well...

<Your Base Search> earliest=-2h latest=now | <Your remaining Search>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...