Alerting

Why is alert fired when subsearch fails? That would be assuming (and wrong).

the_wolverine
Champion

I have a search that is populated by a lookup file and filtering out matches returned by subsearch. When the subsearch fails the alert fires. This is the wrong behavior! The alert should not fire:

Query:

|inputlookup the_list.csv | search NOT [ search index=main | dedup host | fields host ]

When my sub search fails, evidence:
Audit:[timestamp=01-11-2015 00:00:47.651, user=n/a, action=search, info=failed, search_id='subsearch_scheduler_USERNAMEsearch_XXXXXXXXXXXXXX_at_1420934400_28791_1420934427.1', total_run_time=2.97, event_count=0, result_count=0, available_count=0, scan_count=0, drop_count=0, exec_time=1420934427, api_et=1420920000.000000000, api_lt=1420934400.000000000, search_et=1420920000.000000000, search_lt=1420934400.000000000, is_realtime=0, savedsearch_name=""][n/a]

The alert fires! This is the wrong behavior.

0 Karma

tiagofbmm
Influencer

What is the alert based on? Number of events?

0 Karma

valiquet
Contributor

Can you run ?

|inputlookup the_list.csv
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...