0

Our system has Splunk installed and indexing a directory for log files. A search string of "uploaded file" is set at All time (real-time). The search is saved as an alert. When creating the alert real-time, per-result and a trigger of endpoint is selected. The endpoint has been tested. It is bare bones write post to a file for testing for now. It has been put on the local host and on a remote host.

I follow Splunk's online docs. The problem is when the search string is added to the log file it will show up in the real-time search but it is not triggering the actions. How can I trouble shoot this issue?

I find that some say to "Add to Triggered Alerts" and set a priority and this doesn't make a difference.

There is a alert that has been setup years ago that nobody knows how it works. When I duplicate this it will not trigger. When I create a new alert and edit the advanced details to be exactly like the working alert it will not trigger the actions. I do not think it has anything to do with the alert at this point. Is there some place to register an alert to make them trigger?

  • Your first problem is running a real-time, all-time search. Real-time searches are rarely necessary and even then only when the response will be real-time. All-time searches are extremely wasteful when looking for the presence of a string - just look at the last minute or two. What is the action being triggered? What does "trigger of endpoint" mean? Have you looked at splunkd.log and the search log of alert that should have triggered? – RichG Jul 18 at 10:53
  • Is it possible to do real-time instant? I only want reporting for when new things show up in the log and have reporting when others are added. – sdxbp Jul 18 at 19:21
  • Yes, it's possible, but not recommended because of the effect on performance. Did you see my other questions? – RichG Jul 18 at 23:06
  • Thanks. I don't want splunk to report all the logs entries on every one change. We have moved away from real-time to a scheduled process and it seems to be working. Thank you for you feed back. – sdxbp Jul 24 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.