I have an alert defined which should send an email if a search returns no results for a 5 minute time period.
Enabled: Yes.
Alert Type: Real-time.
Trigger Condition: Number of Results is < 1 in 5 minutes.
App: search
Permissions: Shared in App.
The search string is something like this:
host="production*" AND (uri_path="/web/foo" OR uri_path="/web/bar")
This is sending repeated emails, even though there have not been any 5 minute periods where the search returns 0 results.
Clicking on the "view results" link shows a 5 minute period and supposedly shows no results, but clicking on the magnifying glass to perform the search again shows that there are results for the same period.
What is going on here?
Also, clicking on "alert" link from the alert emails shows the alert definition along with " There are no fired events for this alert."
... View more