Our system has Splunk installed and indexing a directory for log files. A search string of "uploaded file" is set at All time (real-time). The search is saved as an alert. When creating the alert real-time, per-result and a trigger of endpoint is selected. The endpoint has been tested. It is bare bones write post to a file for testing for now. It has been put on the local host and on a remote host.
I follow Splunk's online docs. The problem is when the search string is added to the log file it will show up in the real-time search but it is not triggering the actions. How can I trouble shoot this issue?
I find that some say to "Add to Triggered Alerts" and set a priority and this doesn't make a difference.
There is a alert that has been setup years ago that nobody knows how it works. When I duplicate this it will not trigger. When I create a new alert and edit the advanced details to be exactly like the working alert it will not trigger the actions. I do not think it has anything to do with the alert at this point. Is there some place to register an alert to make them trigger?
