Splunk Cloud Platform

kvstore update via scheduled real-time alert


Can anyone give me any hints as to what I might be doing wrong.
I have this query in a scheduled real-time alert where I'm hoping to retain the lastupdated time and lastfault time in a kvstore. If I run the query interactively I get the results I expect, however, running the query as a scheduled real-time alert and nothing is updated in the kvstore.
Any help would be appreciated.

sourcetype="web-heartbeat" `website_monitoring_search_index` `filter_inoperable`
| eval time=_time | eval response_time=total_time | convert ctime(time)
| fillnull response_code value="Connection failed"
| eval response=if(timed_out == "True", "Connection timed out", response_code)
| eval response=if(response_code="", "Connection failed", response_code) | eval state=response
| eval _key=title | eval lastupdated=time() | eval lastfault=time()
| fields - _raw _time | fields _key time title host url response_code response state lastupdated lastfault
| outputlookup website_monitoring_state append=false key_field=_key

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...