Alerting

Why is alert fired when subsearch fails? That would be assuming (and wrong).

the_wolverine
Champion

I have a search that is populated by a lookup file and filtering out matches returned by subsearch. When the subsearch fails the alert fires. This is the wrong behavior! The alert should not fire:

Query:

|inputlookup the_list.csv | search NOT [ search index=main | dedup host | fields host ]

When my sub search fails, evidence:
Audit:[timestamp=01-11-2015 00:00:47.651, user=n/a, action=search, info=failed, search_id='subsearch_scheduler_USERNAMEsearch_XXXXXXXXXXXXXX_at_1420934400_28791_1420934427.1', total_run_time=2.97, event_count=0, result_count=0, available_count=0, scan_count=0, drop_count=0, exec_time=1420934427, api_et=1420920000.000000000, api_lt=1420934400.000000000, search_et=1420920000.000000000, search_lt=1420934400.000000000, is_realtime=0, savedsearch_name=""][n/a]

The alert fires! This is the wrong behavior.

0 Karma

tiagofbmm
Influencer

What is the alert based on? Number of events?

0 Karma

valiquet
Contributor

Can you run ?

|inputlookup the_list.csv
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...