Alerting

Can't activate summary indexing for scheduled alert Splunk 8.0.0

falcalde
Explorer

Hello. Thanks for the help in advance.
I am trying to make an alert that also indexes it's results, so the users can see the activated alert's results in a dashboard later.
The problem is that "log events" action (plus tokens in the event text) fails to save the data correctly when the alert has multiple results.
So i am trying this approach: https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/Updatealerts
However, following the docs page, when i set action.summary_index to "true" and save, it automatically goes back to "false". As if splunk was changing it when i press save.

Here's the search: (it is a test search)
| makeresults count=1
| eval funca = 1
| table funca

Also the alert is set to activate on a CRON schedule every 5 minutes: */5 * * * *
The alert is activating fine because i see it is adding it in the triggered alerts section.
if this is not the way to do this? What's the correct way then?
Thanks!

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!