Alerting
Highlighted

I can't change "action.summary_index" to enable summary indexing in alert.

Builder

My Splunk Ver : 8.0.2

I want enable summary indexing in alert, so I've tried change "action.summary_index" to true from advanced edit by according to below documents.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/Updatealerts#Enable_summary_indexing

But when I click save button, it return to "false", and there isn't some error message.

Is someone know about it?

Labels (1)
Highlighted

Re: I can't change "action.summary_index" to enable summary indexing in alert.

SplunkTrust
SplunkTrust

what exactly do you want to do?
if you want to write the data of the alert to a splunk index, use the Log Event option and choose the place (index) you want the data to be at. read here more:
http://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/LogEvents

0 Karma
Highlighted

Re: I can't change "action.summary_index" to enable summary indexing in alert.

Builder

@adonio

Thank you for comment.
I want to write alert result to summary index, and also I know that collect command make it possible.

I just want to know why I can't change action.summary_index option on GUI.
Is it issue? or specification?

0 Karma
Highlighted

Re: I can't change "action.summary_index" to enable summary indexing in alert.

New Member

After I changed action.summaryindex to true in savedsearches.conf, I got the error when attempted to modify again the alert on the UI 'scheduled search action=summaryindex is not supported with per result alerting', which in my case makes sense, as my alert had this kind of 'multiline' results. So you might be able to convert your alert to trigger 'once' instead for each result depending on your case.

0 Karma