Troubleshoot log-based detectors
Resolve common search, permission, limit, execution, access, and notification problems.
A log-based detector cannot be created, evaluated, investigated, or used to send a notification.
The SPL search is invalid or returns unexpected events.
- Correct the search and run it again.
- Before saving, confirm that the preview returns the expected events and fields.
You do not have permission to create or edit the detector.
- Confirm that your role has necessary capabilities for the requested action.
- Confirm that you have access to the detector and selected connection.
- Confirm that your Splunk permissions include the indexes used by the search.
The organization has reached its log-based detector limit.
Delete an unused log-based detector to release capacity.
An organization can retain 50 non-deleted log-based detectors. Disabling a detector does not release capacity.
You can see a fired alert but cannot open its logs.
Ask an administrator for access to the required connection and Splunk indexes.
Alert visibility does not grant access to raw log data.
The detector fires, but notifications do not arrive.
- Confirm that suppression is not active.
- Confirm that the notification destination is configured and available.