topic Why changes to alerts are not being saved? in Alerting

Why changes to alerts are not being saved?

danielbb — Tue, 03 Dec 2019 21:21:47 GMT

Couple of people experienced it in the past week -

When we make changes to the a Splunk alert, run it, and save it.
When we go back to the query, the changes are not saved and we have to redo it.

What can it be?

Re: Why changes to alerts are not being saved?

woodcock — Tue, 03 Dec 2019 21:45:34 GMT

Either:
1: You are saving it inside of an app that is being controlled by a Deployment Server and the local directory inside of that app on the DS has a savedsearches.conf. If so the DS will continuously overwrite your changes.
2: You are in a Search Head Cluster and the admin of the Deployer is pushing out apps and overwriting your stuff. This latter possibility is the less likely one because it means a human is doing this over and over, which is unlikely.

Re: Why changes to alerts are not being saved?

danielbb — Tue, 03 Dec 2019 22:46:51 GMT

Sorry sorry @woodcock - at some point the changes are being saved.

Re: Why changes to alerts are not being saved?

danielbb — Wed, 04 Dec 2019 14:44:00 GMT

I wonder whether the save action is being tracked, maybe in _audit?