Alerting

Is there a way to inspect an alert?

danielbb
Motivator

A user tells us -

-- When we run a search for the last 10 hrs, we get about 5 results, but when we use the same search in the alert we received about 1000k duplicating alerts.

Is there a way to inspect an alert?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi danielbb,
an alert is a search (like a report and a panel!), so you'll have the same results both in search and in alert if you set the same time range.
The only alert's difference is that, when you open an aler in search, you cannot modify time range.
To modify it, you have to open the alert in [Settings -- Searches, Reports and Alerts].
So check in this form what's the time range you're using.

Bye.
Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...