Search code examples
splunksplunk-query

Getting alert from SPlunk every 30 min even if cron_schedule is 15 min

I have Splunk alert which runs query every 15 min for last 30 min.

My savedsearch.conf looks like this:

dispatch.earliest_time = -30m@m
cron_schedule = */15 * * * *

But anyway, I am getting alert every 30 min, not 15 min. First one I got at 10:55 AM and the next one at 11:25

Solution

  • At 10:55, the alert triggered and started a 20-minute timer. At 11:10, the alert triggered again, but the timer still had 5 minutes left on it so no alerts were sent. Finally, the alert triggered at 11:25, the suppression timer had elapsed, so the alert was sent and a new timer started.