Using the follow.py example script, I get no events when searching using 'index=_audit action=alert_fired'. When I run this search I can go into 'Jobs' and watch it from the GUI and see records returned, but they are not displayed from the python script.
Other searches work as expected (like 'index=_audit action=search'), but the alert_fired action returns no events.
The only difference I can find is searches that return events to the Python script show a '< results preview='0'/>' while the alert_fired returns '< results preview='1'/>'.
... View more