In handler 'savedsearch': Expecting different token Above error pop while creating an alert. Is there any fix? ... View more

Alert is not triggered via email. I have a search that returns more event count (apprx more than 10k for 6hrs)which is affecting the default value setting responsible for email trigger:I have created a summary index as well and to run the report once in a week still the email is not being triggered because of huge event count. Below is the option i have got to modify the default values:   $SPLUNK_HOME/etc/system/local/limits.conf [scheduler] max_action_results = 175000 [searchresults] maxresultrows = 175000 $SPLUNK_HOME/etc/system/local/alert_actions.conf [default] maxresults = 175000 this enables an email alert containg a .csv to have 175k rows Is there any other option other than above,as it is not recommened to change my default value in our infra so that we can send the report via email?   ... View more

Hi How do i extract my field using rex; Below is the sample log: "{"xxxx":{"zzzz":"405","statusMessage":"Added","zzzzzzz":false}}", ... View more