Alerting

Why are alerts not triggered for searches using newly created indexes?

victorxbox
New Member

Hi All,

I get a problem in alert configuration. I find that the alerts can be triggered successfully when the alert is searching the main index, but my newly created indexes are failed to trigger any alerts. Could anyone advise on this issue?

PS: my savedsearch config is under the "search" app with the owner "admin"

Tags (2)
0 Karma

woodcock
Esteemed Legend

Debug it by logging as user admin and running the alert's search, peeling off piped clauses from the right side until you get data that you expect. There could be a problem with permissions or maybe even the "indexes searched by default" setting; to eliminate the latter, be sure to explicitly sent your index with index=* or similar.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...