Reporting

Splunk notification Issues

sreejithpoothu
New Member

Hi,

I have a scheduled search for ERROR from particular log which runs every hour and if there is any error will send alert through mail.But in some times we are getting mail only after 3 or 4 hours when error happens.If an error happens on 1:00am, we are getting notification at 5 am not at 2:00am as per the schedule.I dont have any clue how to debug this.Please help?

Regards
Sreejith.A

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

sreejithpoothu
New Member

We didnt see any error from logs.The issue is that our forwader is on UTC and indexer is on EST.When error happens on 01:00UTC ,splunk sends mail at 01:00 EST.Is ther any way we can fix this?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

You can use the instructions here to troubleshoot what is happening:

http://splunk-base.splunk.com/answers/32498/how-to-troubleshoot-splunk-email-notification

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...