Alerting

Why changes to alerts are not being saved?

danielbb
Motivator

Couple of people experienced it in the past week -

When we make changes to the a Splunk alert, run it, and save it.
When we go back to the query, the changes are not saved and we have to redo it.

What can it be?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Either:
1: You are saving it inside of an app that is being controlled by a Deployment Server and the local directory inside of that app on the DS has a savedsearches.conf. If so the DS will continuously overwrite your changes.
2: You are in a Search Head Cluster and the admin of the Deployer is pushing out apps and overwriting your stuff. This latter possibility is the less likely one because it means a human is doing this over and over, which is unlikely.

danielbb
Motivator

Sorry sorry @woodcock - at some point the changes are being saved.

danielbb
Motivator

I wonder whether the save action is being tracked, maybe in _audit?

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...