Alerting
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

Why are alerts not being triggered for all the events when trigger is set to "For Each Result"?

dshah_splunk
Splunk Employee
Splunk Employee
‎09-20-2019 07:55 AM

I have created a scheduled search of the type:

index=_internal | head 100

Now, I have kept the cron schedule, such that this search will execute every 5 minutes. And the trigger mode is "For Each Result". So, for 100 results, 100 alerts must be fired.

Now, the alerts are only triggered for 5 minutes. So, let's say for the scheduled search with sid=sid1 has executed 50 alerts for 50 events. After 5 minutes, search with sid2 is triggered. Now, the alerts for sid1 are stopped, and it will continue for sid2.

Is this known behaviour of Splunk? Can we change this?

0 Karma
Reply
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...