Alert Action = Always is not available via GUI in 6.6

[rphillips_splk]

My alerts which were set to 'always' trigger aren't triggering after upgrading to 6.6.x

In Splunk versions earlier than 6.6 the Searches, Reports and Alerts GUI had allowed for an Alert Condition = always. This option has been removed from the UI in 6.6 and now the default trigger conditions are Trigger alert when number of results is greater than 0. How can I restore my alerts to always trigger after upgrading to 6.6?

[mtzo81]

I have contacted Splunk support and here's their reply.

There was not a design change in 6.6x, it's more kind of bug fixing in newer version. Before with the old manager saved search page there was no way of knowing if what you were editing was an alert or a report so all options for alert_type were displayed. It was more of a bug that you could select alert_type = always and then set other attributes that made the saved search an alert vs a scheduled report. Ideally what the old ui would of done is if the user selected alert_type = always the other attributes would be limited so the user could only create a scheduled search not an alert. It would be appropriate to add "always" to the drop down. But **it doesn't makes sense that an alert would have alert_type = always, an alert needs a reason to trigger. A scheduled saved search that always triggers should be a scheduled report not an alert. The current behavior seen in 6.6x enables distinction between alerts and reports and the their respective properties. alert_type = always is for scheduled reports and does not need to appear in the workflow for creating/editing alerts.

Basically, the removal of alert_type=always is not a bug, it's more of design change. Hope it will help clear doubt for people like me. 🙂

[rphillips_splk · Accepted solution]

This issue has been raised under bug SPL-142554 and marked to be fixed in 6.6.3
In the meantime the following workaround can be used by editing the alert via the UI in :
settings>searches,reports,&alerts>edit alert > advanced edit>
The fields in question are the following, with their corresponding savedsearches.conf attribute name under it with the #prefix

to edit the alert back to trigger 'always' set the following in the advanced edit UI for the alert:
alert_comparator =

relation

alert_condition =

alert_condition

alert_type = always

counttype

alert_threshold =

quantity

Save
Since this change is made via the UI it will be replicated to all members in a search head cluster after changing it on one member.

[mtzo81]

I still encounter the same issue after upgraded to 6.6.5. I would like to check when the issue will be fixed?

Thanks
Terence Thant