Alerting

I can't change "action.summary_index" to enable summary indexing in alert.

yutaka1005
Builder

My Splunk Ver : 8.0.2

I want enable summary indexing in alert, so I've tried change "action.summary_index" to true from advanced edit by according to below documents.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/Updatealerts#Enable_summary_indexing

But when I click save button, it return to "false", and there isn't some error message.

Is someone know about it?

Labels (1)

karapet
New Member

After I changed action.summary_index to true in savedsearches.conf, I got the error when attempted to modify again the alert on the UI 'scheduled search action=summary_index is not supported with per result alerting', which in my case makes sense, as my alert had this kind of 'multiline' results. So you might be able to convert your alert to trigger 'once' instead for each result depending on your case.

0 Karma

adonio
SplunkTrust
SplunkTrust

what exactly do you want to do?
if you want to write the data of the alert to a splunk index, use the Log Event option and choose the place (index) you want the data to be at. read here more:
http://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/LogEvents

0 Karma

yutaka1005
Builder

@adonio

Thank you for comment.
I want to write alert result to summary index, and also I know that collect command make it possible.

I just want to know why I can't change action.summary_index option on GUI.
Is it issue? or specification?

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on