Hello,
In our Splunk environment, we have saved searches deployed in default because of how we do version control and dev to prod deployments. When users make changes in the UI, it gets saved in local. When we promote to prod, default and local get merged.
For saved searches that have been configured with inline emails, in default the saved searches have:
action.email.inline = 1
We have found when a user wants to disable inline, when the checkbox is un-selected in the alert, saved searches in local do not get action.email.inline = 0.
In some of my testing where I created an alert that didn't already exist in default, adding inline creates action.email.inline = 1, but when unchecking inline in the alert, the action.email.inline line is deleted by Splunk in local.
Is this to be expected where a configuration that sets to 1 in savedsearches.conf, doesn't set to 0? This is causing us issues because of the fact we have action.email.inline = 1 in default, but when users want to turn it off, it doesn't get turned off because the line still exists in default and local isn't updated with action.email.inline = 0.
