We are having this same issue, 7 years later on Splunk 9.04.1. Has anyone identified a solution? We have a cron job running every 6 hours which deletes all files. Additionally, we added an IgnoreOlderThan = 6h to our inputs.conf, but it did not make any impact and we are still using 100% swap memory, instead of system memory. ... View more

6 years later and this solution is still relevant. Works perfectly in XML. ... View more

If you are looking to @ a user group within the Slack alert, I found this in the Slack API docs. Tested and confirmed, it works. https://api.slack.com/reference/surfaces/formatting#linking_to_channels_and_users To mention a user group in app-published text, you need to provide the group ID in the following general syntax: `<!subteam^ID>` !subteam^ is a literal string that should not change, but ID should be replaced with the actual user group ID. Here's an example: Hey <!subteam^SAZ94GDB8>, there's a new task in your queue. Your app can get this group ID from the Event API payload sent when one of the subteam event types occurs, or by looking them up via the usergroups.list Web API. You can also manually retrieve a specific user group's ID from the URL shown when viewing its profile (highlighted here): When text containing the user group mention syntax is published by an app, the ID will be automatically converted to show the name of the user group. ... View more