Bug in alert condition when summary index enabled?

[phoenixdigital]

Hi All,

If you create a saved search in the web interface and then set the alert condition to 'if custom condition is met' then enter a custom condition search.

See second image here http://imgur.com/a/qIe8z

Then before pressing submit you tick enable to summary indexing. This resets the settings you made above.

See first image here http://imgur.com/a/qIe8z

I have tested this on two different instances of Splunk (5.0.2 and 5.0.1) and the bug exists on both versions.

Worse the issue also happens when you go back in to edit the search. Even when 'if custom condition is met' is set in the savedsearches.conf it will reset back if summary indexing is enabled. So if the user does not know about this bug they will lose their alert condition settings.

Are others seeing this with their versions of Splunk?

I have submitted this as a bug but was curious if others can reproduce?

[sloshburch]

Would it work to use loadjob or savedsearch commands to pull up the recent run and conditionally alert upon that?

[mpawar_splunk]

This is not a bug but an expected behavior because summary indexing for an alert cannot be conditional.
If you want to use other alert conditions, you must disable summary indexing.

[jrodriguezap]

No way to add the "if number of events" ???
It is very important to get this

[jds123]

Although this is expected behavior, what if you are trying to have an email alert action and summary indexing in the same saved search? By forcing the "always" condition, emails alerts will trigger every time the search runs.