My Splunk Ver : 8.0.2
I want enable summary indexing in alert, so I've tried change "action.summary_index" to true from advanced edit by according to below documents.
But when I click save button, it return to "false", and there isn't some error message.
Is someone know about it?
what exactly do you want to do?
if you want to write the data of the alert to a splunk index, use the Log Event option and choose the place (index) you want the data to be at. read here more:
Thank you for comment.
I want to write alert result to summary index, and also I know that
collect command make it possible.
I just want to know why I can't change
action.summary_index option on GUI.
Is it issue? or specification?
After I changed action.summaryindex to true in savedsearches.conf, I got the error when attempted to modify again the alert on the UI 'scheduled search action=summaryindex is not supported with per result alerting', which in my case makes sense, as my alert had this kind of 'multiline' results. So you might be able to convert your alert to trigger 'once' instead for each result depending on your case.