Splunk ver 7.2.3
I created an alert using a macro, and confirmed the operation.
Then, the alert trigger operation itself worked well, but when I confirmed the result from "View Results", the result is not displayed for some reason.
Is this due to using macros in alerts?
If anyone know about it, please tell me.
That is a bug. Open a support case and post the jira back here for reference.
I'm not sure but if all mentioned fields in search (using
table command) doesn't have any data then might be stats count showing but not report,
Can you please share
It is just test, so
definition is below.
makeresults count=1 | eval status="aaaaa"