Alerting

Can't activate summary indexing for scheduled alert Splunk 8.0.0

falcalde
Explorer

Hello. Thanks for the help in advance.
I am trying to make an alert that also indexes it's results, so the users can see the activated alert's results in a dashboard later.
The problem is that "log events" action (plus tokens in the event text) fails to save the data correctly when the alert has multiple results.
So i am trying this approach: https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/Updatealerts
However, following the docs page, when i set action.summary_index to "true" and save, it automatically goes back to "false". As if splunk was changing it when i press save.

Here's the search: (it is a test search)
| makeresults count=1
| eval funca = 1
| table funca

Also the alert is set to activate on a CRON schedule every 5 minutes: */5 * * * *
The alert is activating fine because i see it is adding it in the triggered alerts section.
if this is not the way to do this? What's the correct way then?
Thanks!

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...