Archive
Highlighted

Why are alerts not working after upgrade to Splunk 6.5.1?

Explorer

Hi,

All of our alerts are not working after the upgrade to Splunk 6.5.1 from 6.3.0.

In the scheduler.log I have this error:

ERROR SavedSplunker - vector::Mrangecheck: _n (which is 0) >= this->size() (which is 0)

Anyone else have this issue ?

Thanks !

Tags (1)
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Ultra Champion

An identical error message when upgrading to 6.5.0 -

ERROR SavedSplunker - vector::_M_range_check: __n (which is 0) >= this->size() (which is 0)

It's at Why are alerts not working after upgrade to Splunk 6.5.0?

@alewkowicz says -

alt text

0 Karma
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Explorer

Reporter of the issue was using 6.5.0 but out version is 6.5.1, which this issue is supposed to be fixed.

0 Karma
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Explorer

I downvoted this post because the issue is with 6.5.1, not 6.5.0

0 Karma
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Ultra Champion

You must be joking, right? ; -) it's the same issue and we are here to assist you at any time ....

0 Karma
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Explorer

Sorry for the confusion but we are using 6.5.1 version. @alewkowicz experienced this issue with 6.5.0 version Splunk support reported that it will be fixed in 6.5.1. Do you mean that the issue may not still be 6.5.1?

0 Karma
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Ultra Champion

You see the issue, right? ; -) So, apparently, it's still there...

0 Karma
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Ultra Champion

Splunk via @christopherr said the following in the other thread -

alt text

0 Karma
Highlighted

Re: Why are alerts not working after upgrade to Splunk 6.5.1?

Influencer

In our case it was a stats/chart command with a repeated field.

| stats last(fieldA) as fieldA ... last(fieldA) as fieldA

As soon as we removed the repeated fields, scheduling started firing.

0 Karma