Alerts/Searches not to show up in the UI

[sylim_splunk]

From time to time some searches or alerts are not running. Owners of the KB found those are in the savedsearches with some attributies missing including "search = ".

Each time we found the issue from some objects we corrected them by recreating with the attributes but it keeps happening to many alerts/searches.

We are using the version 8.2.1 with SHC of 12 members.

[sylim_splunk · Accepted solution]

This has been reported in 8.2.0 and 8.2.1, fixed in the version 8.2.2+.

The symptoms are as below ;

- Some searches/alerts stopped running as scheduled

- They don't show up in the search in UI,  'Settings> searches, reports and alerts'

- In the savedsearches.conf  they are there but without some attributes, including 'search'.

Find the description for SPL-207554 in the link below.

 https://docs.splunk.com/Documentation/Splunk/8.2.2/ReleaseNotes/Fixedissues