We have a number of RT searches that we alert on. All were working fine. for several months. I cannot pin-point the time that they stopped working, but they all have stopped working. I have disabled all Splunk apps with no change in result. A simple search to alert on a config change in a router such as "host=192.168.1.1 logged command" will alert with a search window of earliest=-1m latest=now run every minute, but will not alert when configured for real-time. This alert has worked for months. I am not sure what event has caused it to cease.
