Log event trigger action not working as expected

Applicability

Splunk Cloud Splunk Enterprise

Description

Created a new index named "index_a" and configured a new alert with trigger actions set to log the event results into the new index. 

The alert is being triggered as expected and does produce results. However, unable to locate these events in the target index "index_a". 

Investigation

Reviewing the alert via the WebUI (SH WebUI > Alerts > select Alert name) the following conditions are set: 

• Permissions are set to Shared in App (in this case a custom app). 
• Trigger conditions are if the number of results is greater than zero.
• Actions are: Add to Triggered Alerts, Log Event (with sourcetype=sourcetype_a and index=index_a).
• Trigger history displays its executing as expected and there are results.

Reviewing the newly created index where these results should be stored display an event count of 0.


 

Resolution

As per documentation, using the log event alert action requires the edit_log_alert_event capability. 

edit_log_alert_event - Lets a user log an event when an alert condition is met. Also lets the user select the "Log an event" option for an alert action in Splunk Web.

While reviewing the configured Alert, the owner (user who created this alert) is listed. In this case, username: "userA"

Executing the following SPL query for "userA" lists the roles and capabilities of this user, which does not contain the edit_log_alert_event capability.

| rest splunk_server=local /servicesNS/-/-/authentication/users
| stats values(realname) AS Name values(type) as Authentication values(capabilities) as Capabilities values(roles) as Roles by title
| rename title AS ID
| search ID="userA"

As per the above, the below steps resolve this issue: 

1. Add the edit_log_alert_event capability to a Role assigned to this user. 
2. Made a dummy change to the Alert, to resave the configuration. 
3. Re-test the Alert and confirm the results are now saved into the expected index. 

Related Links

Log Alert Documentation

Roles and Capabilities

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release