Why are alerts not working after upgrade to Splunk 6.5.1?

[levent_kurt]

Hi,

All of our alerts are not working after the upgrade to Splunk 6.5.1 from 6.3.0.

In the scheduler.log I have this error:

ERROR SavedSplunker - vector::_M_range_check: __n (which is 0) >= this->size() (which is 0)

Anyone else have this issue ?

Thanks !

[twinspop]

In our case it was a stats/chart command with a repeated field.

| stats last(fieldA) as fieldA ... last(fieldA) as fieldA

As soon as we removed the repeated fields, scheduling started firing.

[ddrillic]

An identical error message when upgrading to 6.5.0 -

ERROR SavedSplunker - vector::_M_range_check: __n (which is 0) >= this->size() (which is 0)

It's at Why are alerts not working after upgrade to Splunk 6.5.0?

@alewkowicz says -

[levent_kurt]

I downvoted this post because the issue is with 6.5.1, not 6.5.0

[ddrillic]

You must be joking, right? ; -) it's the same issue and we are here to assist you at any time ....

[levent_kurt]

Sorry for the confusion but we are using 6.5.1 version. @alewkowicz experienced this issue with 6.5.0 version Splunk support reported that it will be fixed in 6.5.1. Do you mean that the issue may not still be 6.5.1?

[ddrillic]

You see the issue, right? ; -) So, apparently, it's still there...

[ddrillic]

Splunk via @christopherr said the following in the other thread -

[levent_kurt]

Reporter of the issue was using 6.5.0 but out version is 6.5.1, which this issue is supposed to be fixed.