Why is the updated value for a macro being ignored in the search for a real time alert?

[da029jo]

We are using a macro to maintain a list of hosts that are "under maintenance" and updating the value of this macro using REST.
We use this macro in a real time alert search created to alert us to errors on our servers.

It seems that even though the search works fine when we run it through Splunk Web, the updated macro value is being "ignored" when the alerts are triggered.....

[da029jo · Accepted solution]

It seems that the nature of a realtime search, meaning that a thread is "kept open" means that updates to the macro value are not reflected in the alert. This explains the behaviour we were seeing. The resolution we found was to change the alert to be a scheduled search every 1min (for example) and use the @minute-1minute to @minute as the range. This does mean we only get alerts every minute and not "truely" realtime but the solution means the macro value is now reflected so it is an acceptable solution.

[sloshburch]

Whoever thought of that solution must be brilliant 😉 Thanks for posting about this!