Hi All,
We had setup an alert that runs everyday, it's been working fine until today. Today, we see that alert is triggered with no results, but when we run search same search for same timerange, it is showing the results.
Here is the entry in the scheduler.log
03-26-2020 03:20:36.406 -0400 INFO SavedSplunker - savedsearch_id="nobody;myapp;alertname", search_type="scheduled", user="test", app="myapp", savedsearch_name="alertname", priority=default, status=success, digest_mode=1, scheduled_time=1585207200, window_time=0, dispatch_time=1585207235, run_time=0.170, result_count=1, alert_actions="email", sid="scheduler__test_Qk1TX1dNX0lOVEdfTUVUUklDUw__RMD522d64366074c1a92_at_1585207200_23138", suppressed=0, thread_id="AlertNotifierWorker-0"
When I tried checking the results of the triggered alert, it is showing that the alert was no longer exist, and when I tried with
|loadjob scheduler__test_Qk1TX1dNX0lOVEdfTUVUUklDUw__RMD522d64366074c1a92_at_1585207200_23138 it says that sid doesn't exist.
I have checked in the dispatch directory and I don't a directory with the name of the that sid.
Could anyone help me to see to find out what were the results of the alert and if any issues with the alert
