topic Re: Saved search not writing output to the lookup file in Dashboards & Visualizations

Saved search not writing output to the lookup file

spkriyaz — Tue, 11 Aug 2020 10:12:01 GMT

Hi,

Absolutely strange 😞

I have a search which writes the output to the lookup file, if I run this search in search head it writes the output to the lookup file BUT if I save this search as an alert and run it then it is not writing it to the lookup file even if the alert is triggered and search has ran successfully.

Any idea?

Thanks,

Re: Saved search not writing output to the lookup file

gcusello — Tue, 11 Aug 2020 10:39:17 GMT

Hi @spkriyaz,

I think that your alert is in the same search head where you run the search.

check in [Activity -- Triggered Alert] if there's the run of your alert and if there are results.

Then, did you created the Lookup Definition related to your lookup?

Ciao.

Giuseppe

Re: Saved search not writing output to the lookup file

spkriyaz — Tue, 11 Aug 2020 11:15:51 GMT

Found the issue by analyzing _internal log, looks like I have set 24 hours as expiry for most of my saved searches which has filled the disk quota. My user has 1000MB disk quota limit which I was crossing. I have purged the old jobs in Activity-> jobs which has freed the disk quota now.

This solves the issue now 🙂