Why are the alert results not getting ingested to newly created index?

[nivets]

I have a alert which is running to find few values and i need to write the result of the alert to new index which has created.

I have used alert action as log event and mentioned the new index which has created to write the output of the alert. but the output is getting ingested to new index but when i tried with main (default index) the output of the alert is getting ingested.

the newly created index is working, i tried checking ingesting other data manually with files. so, what could be the issue , the alert results are not getting ingested to newly created index.

[gcusello]

Hi @nivets,

you should save alerts results in a summary index using the collect command (https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Collect).

And then you can run searches on this summary index.

Ciao.

Giuseppe