Alerting

In alert using a macro, even if the alert is triggered, but it can not be seen when checking from "View Results".

yutaka1005
Builder

Splunk ver 7.2.3

I created an alert using a macro, and confirmed the operation.
Then, the alert trigger operation itself worked well, but when I confirmed the result from "View Results", the result is not displayed for some reason.

Is this due to using macros in alerts?

If anyone know about it, please tell me.

alt text

woodcock
Esteemed Legend

That is a bug. Open a support case and post the jira back here for reference.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yutaka1005

I'm not sure but if all mentioned fields in search (using fields or table command) doesn't have any data then might be stats count showing but not report,

Can you please share definition ?

0 Karma

yutaka1005
Builder

It is just test, so definition is below.

makeresults count=1 | eval status="aaaaa"

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...