All of our alerts are not working after the upgrade to Splunk 6.5.1 from 6.3.0.
In the scheduler.log I have this error:
ERROR SavedSplunker - vector::Mrangecheck: _n (which is 0) >= this->size() (which is 0)
Anyone else have this issue ?
An identical error message when upgrading to 6.5.0 -
ERROR SavedSplunker - vector::_M_range_check: __n (which is 0) >= this->size() (which is 0)
@alewkowicz says -
Sorry for the confusion but we are using 6.5.1 version. @alewkowicz experienced this issue with 6.5.0 version Splunk support reported that it will be fixed in 6.5.1. Do you mean that the issue may not still be 6.5.1?
In our case it was a stats/chart command with a repeated field.
| stats last(fieldA) as fieldA ... last(fieldA) as fieldA
As soon as we removed the repeated fields, scheduling started firing.