topic Re: Bug in alert condition when summary index enabled? in Knowledge Management

Bug in alert condition when summary index enabled?

phoenixdigital — Mon, 03 Jun 2013 00:23:38 GMT

Hi All,

If you create a saved search in the web interface and then set the alert condition to 'if custom condition is met' then enter a custom condition search.

See second image here http://imgur.com/a/qIe8z

Then before pressing submit you tick enable to summary indexing. This resets the settings you made above.

See first image here http://imgur.com/a/qIe8z

I have tested this on two different instances of Splunk (5.0.2 and 5.0.1) and the bug exists on both versions.

Worse the issue also happens when you go back in to edit the search. Even when 'if custom condition is met' is set in the savedsearches.conf it will reset back if summary indexing is enabled. So if the user does not know about this bug they will lose their alert condition settings.

Are others seeing this with their versions of Splunk?

I have submitted this as a bug but was curious if others can reproduce?

Re: Bug in alert condition when summary index enabled?

mpawar_splunk — Fri, 27 Sep 2013 19:04:07 GMT

This is not a bug but an expected behavior because summary indexing for an alert cannot be conditional.
If you want to use other alert conditions, you must disable summary indexing.

Re: Bug in alert condition when summary index enabled?

jds123 — Tue, 16 Sep 2014 18:24:50 GMT

Although this is expected behavior, what if you are trying to have an email alert action and summary indexing in the same saved search? By forcing the "always" condition, emails alerts will trigger every time the search runs.

Re: Bug in alert condition when summary index enabled?

jrodriguezap — Thu, 09 Oct 2014 15:30:36 GMT

No way to add the "if number of events" ???
It is very important to get this

Re: Bug in alert condition when summary index enabled?

sloshburch — Thu, 03 Aug 2017 13:01:34 GMT

Would it work to use loadjob or savedsearch commands to pull up the recent run and conditionally alert upon that?