If you’re using Splunk for Alerting, there is a problem that can occur where an event: Is generated before a scheduled search is executed But is only received after the search is done This will mean that: The scheduled search that should inspect the time-frame where the event was generated will not find the event,…
Splunk – How to deal with delayed events in Alerts
Posted on