My alerts which were set to 'always' trigger aren't triggering after upgrading to 6.6.x
In Splunk versions earlier than 6.6 the Searches, Reports and Alerts GUI had allowed for an Alert Condition =
always. This option has been removed from the UI in 6.6 and now the default trigger conditions are Trigger alert when
number of results
is greater than 0. How can I restore my alerts to always trigger after upgrading to 6.6?
This issue has been raised under bug
SPL-142554 and marked to be fixed in
In the meantime the following workaround can be used by editing the alert via the UI in :
settings>searches,reports,&alerts>edit alert > advanced edit>
The fields in question are the following, with their corresponding savedsearches.conf attribute name under it with the #prefix
to edit the alert back to trigger 'always' set the following in the advanced edit UI for the alert:
alert_type = always
Since this change is made via the UI it will be replicated to all members in a search head cluster after changing it on one member.
I still encounter the same issue after upgraded to 6.6.5. I would like to check when the issue will be fixed?
I have contacted Splunk support and here's their reply.
There was not a design change in 6.6x, it's more kind of bug fixing in newer version. Before with the old manager saved search page there was no way of knowing if what you were editing was an alert or a report so all options for alerttype were displayed. It was more of a bug that you could select alerttype = always and then set other attributes that made the saved search an alert vs a scheduled report. Ideally what the old ui would of done is if the user selected alert_type = always the other attributes would be limited so the user could only create a scheduled search not an alert. It would be appropriate to add "always" to the drop down. But *it doesn't makes sense that an alert would have alerttype = always, an alert needs a reason to trigger**. A scheduled saved search that always triggers should be a scheduled report not an alert. The current behavior seen in 6.6x enables distinction between alerts and reports and the their respective properties. alerttype = always is for scheduled reports and does not need to appear in the workflow for creating/editing alerts.*
Basically, the removal of alert_type=always is not a bug, it's more of design change. Hope it will help clear doubt for people like me. 🙂