From time to time some searches or alerts are not running. Owners of the KB found those are in the savedsearches with some attributies missing including "search = ".
Each time we found the issue from some objects we corrected them by recreating with the attributes but it keeps happening to many alerts/searches.
We are using the version 8.2.1 with SHC of 12 members.
This has been reported in 8.2.0 and 8.2.1, fixed in the version 8.2.2+.
The symptoms are as below ;
- Some searches/alerts stopped running as scheduled
- They don't show up in the search in UI, 'Settings> searches, reports and alerts'
- In the savedsearches.conf they are there but without some attributes, including 'search'.
Find the description for SPL-207554 in the link below.
https://docs.splunk.com/Documentation/Splunk/8.2.2/ReleaseNotes/Fixedissues
This has been reported in 8.2.0 and 8.2.1, fixed in the version 8.2.2+.
The symptoms are as below ;
- Some searches/alerts stopped running as scheduled
- They don't show up in the search in UI, 'Settings> searches, reports and alerts'
- In the savedsearches.conf they are there but without some attributes, including 'search'.
Find the description for SPL-207554 in the link below.
https://docs.splunk.com/Documentation/Splunk/8.2.2/ReleaseNotes/Fixedissues