Hi    I was trying to delete an alert created by a user but splunk gives an error saying Could not find object id=abc   Are you sure you want to delete ab+c?   Actually,  user created 2 alerts with name abc and other with name ab+c (They just added this + symbol extra and rest of the things were all same) Now if we try to delete ab+c alert splunk gives error mentioned above. Could anyone tell me why is this hapening and how can I delete the alert? ... View more

Hi All can someone suggest an easy way where i can convert the status indicator panels into a list view of a dashboard?   Thanks in adv! ... View more

I want to trigger an alert only when the results are changed. The frequency of my alert is 15 mins, So the next Alert that I must get only when the the message is different I'm trying to compare the current Index results with previous results using Lookup but How to compare these messages? earliest=-60m@m index=* fail | rex field=_raw ": (?P.*)" | stats earliest(_time) as Earliest, latest(_time) as Latest, count by Error | eval Earliest=strftime(Earliest, "%F %T"), Latest=strftime(Latest, "%F %T") | table Earliest, Latest, Error, count |append [| inputlookup test.csv ] I want to compare the Error field and return results only if current Error field is different ... View more