Alerting

Splunk Email Alerting problem

paulwang
Engager

I have a small instance of splunk installed and we are currently adding users to create their own saved searches. For some reason I have a user that no email alerts work from their saved searches. If I create a schedule for the saved search directly it still does not work. The only work around currently is to recreate the search under my username and make the email alert from there. I have tested the simplest example, doing a * search for the last minute every minute. That search email alerts just fine from my saved search but does not work from the other users saved search (emailing the same account). I've done an index=_internal "*@company.com" search on the internal logs and I see my successful results but nothing for the other users.

Please advise and thanks in advance

Tags (3)
0 Karma
1 Solution

paulwang
Engager

Solved: For some reason, once i remove the "Time Zone" setting at the user level and leave it as "-- Default System Timezone --" the alerts start sending, even though they were reporting as being sent with a time zone but were not actually sending the email.

I'm certain that this is a bug that should be investigated.

View solution in original post

0 Karma

paulwang
Engager

Solved: For some reason, once i remove the "Time Zone" setting at the user level and leave it as "-- Default System Timezone --" the alerts start sending, even though they were reporting as being sent with a time zone but were not actually sending the email.

I'm certain that this is a bug that should be investigated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...