i found another solution that you change configuration in $SPLUNK_HOME/etc/apps/alert_manager/default/collections.conf , then add text below in bottom of the files [drilldown_settings] enforceTypes = true field.type = string field.field = string field.disabled = bool field.label = string field.search = string field.comment = string save its and restart splunk service, after that the WARNING is nothing 😄 reference change from github: https://github.com/alertmanager/alert_manager/commit/d6b0836579805428217dac2c5b0a5a0e32b4c87f#diff-26d29611bf210eea85b03369f1c811d0 ... View more