Alerting

real-time search/alerting

a212830
Champion

Hi,

One of my customers enabled a real-time search and alerting that has started sending out thousands of messages. Some of these alerts are based upon data that is over a year old. The logs that provide this data were recently added, but I don't understand why old data would get triggered from a real-time search.

Tags (2)
0 Karma

Ayn
Legend

Because realtime searches search over all incoming data as it comes in in real time, regardless of the events' timestamps.

0 Karma

a212830
Champion

Thanks. Is there a way to have a "continuous" search running that only looks at recent events?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...