Alerting

Why changes to alerts are not being saved?

danielbb
Motivator

Couple of people experienced it in the past week -

When we make changes to the a Splunk alert, run it, and save it.
When we go back to the query, the changes are not saved and we have to redo it.

What can it be?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Either:
1: You are saving it inside of an app that is being controlled by a Deployment Server and the local directory inside of that app on the DS has a savedsearches.conf. If so the DS will continuously overwrite your changes.
2: You are in a Search Head Cluster and the admin of the Deployer is pushing out apps and overwriting your stuff. This latter possibility is the less likely one because it means a human is doing this over and over, which is unlikely.

danielbb
Motivator

Sorry sorry @woodcock - at some point the changes are being saved.

danielbb
Motivator

I wonder whether the save action is being tracked, maybe in _audit?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...