Archive

Why changes to alerts are not being saved?

Motivator

Couple of people experienced it in the past week -

When we make changes to the a Splunk alert, run it, and save it.
When we go back to the query, the changes are not saved and we have to redo it.

What can it be?

Tags (1)
0 Karma

Esteemed Legend

Either:
1: You are saving it inside of an app that is being controlled by a Deployment Server and the local directory inside of that app on the DS has a savedsearches.conf. If so the DS will continuously overwrite your changes.
2: You are in a Search Head Cluster and the admin of the Deployer is pushing out apps and overwriting your stuff. This latter possibility is the less likely one because it means a human is doing this over and over, which is unlikely.

Motivator

Sorry sorry @woodcock - at some point the changes are being saved.

Motivator

I wonder whether the save action is being tracked, maybe in _audit?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!