Saved search not writing output to the lookup file

[spkriyaz]

Hi,

Absolutely strange 😞

I have a search which writes the output to the lookup file, if I run this search in search head it writes the output to the lookup file BUT if I save this search as an alert and run it then it is not writing it to the lookup file even if the alert is triggered and search has ran successfully.

Any idea?

Thanks, 

[gcusello]

Hi @spkriyaz,

I think that your alert is in the same search head where you run the search.

check in [Activity -- Triggered Alert] if there's the run of your alert and if there are results.

Then, did you created the Lookup Definition related to your lookup?

Ciao.

Giuseppe

[spkriyaz · Accepted solution]

Found the issue by analyzing _internal log, looks like I have set 24 hours as expiry for most of my saved searches which has filled the disk quota. My user has 1000MB disk quota limit which I was crossing. I have purged the old jobs in Activity-> jobs which has freed the disk quota now.

This solves the issue now 🙂