Alerting

Can't activate summary indexing for scheduled alert Splunk 8.0.0

falcalde
Explorer

Hello. Thanks for the help in advance.
I am trying to make an alert that also indexes it's results, so the users can see the activated alert's results in a dashboard later.
The problem is that "log events" action (plus tokens in the event text) fails to save the data correctly when the alert has multiple results.
So i am trying this approach: https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/Updatealerts
However, following the docs page, when i set action.summary_index to "true" and save, it automatically goes back to "false". As if splunk was changing it when i press save.

Here's the search: (it is a test search)
| makeresults count=1
| eval funca = 1
| table funca

Also the alert is set to activate on a CRON schedule every 5 minutes: */5 * * * *
The alert is activating fine because i see it is adding it in the triggered alerts section.
if this is not the way to do this? What's the correct way then?
Thanks!

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...