Additional alert configuration options

It is recommended to create alerts in the Search page and edit them from the Alerts page. In rare cases, authorized users might access the Searches, reports, and alerts page for the following configurations.

---

Enable summary indexing

Summary indexing is available on scheduled alerts. It can help you perform analysis or report on large amounts of data over long time ranges. Typically, this is time consuming and can impact performance if several users are running similar searches on a regular basis.

Prerequisites
Ensure that the alert's search generates statistical or summary data.

Steps

1. Using the top-level navigation bar, select Settings > Searches, Reports, and Alerts.
   
2. Click Edit > Advanced Edit for the alert you'd like to modify.
   
3. To enable the summary index to gather data on a regular interval, search for "alert_type" in the search widow in the upper-left section of the window. Set alert_type to always.
   
4. For a scheduled alert, search for "summary" to view the summary index options. Set action.summary_index to true. If not already specified, this sets the Alert condition to "Always". This option is not available for real-time alerts.
5. Click Save.
   

---

Searches and summary indexing

To use summary indexing with an alert, create a search that computes statistics or a summary for events over a period of time. Search results are saved into a summary index that you designate. You can search over this smaller summary index instead of working with the larger original dataset.

It is typical to use reporting commands in a search that populates a summary index. See Use summary indexing for increased reporting efficiency in the Knowledge Manager manual.

---

Update triggered alert record lifespans

By default, each triggered alert record on the Triggered Alerts page expires after 24 hours. You can update the lifespans for triggered alert records on a per-alert basis.

Here are steps for updating the lifespans of the triggered alert records for a specific alert. These steps apply only to alerts that have the "Add to Triggered Alerts" action enabled.

1. From the top-level navigation bar, select Settings > Searches, reports, and alerts.
2. (Optional) Select Type > Alerts to filter the list so it displays only alerts.
3. Locate the alert that you want to modify under Name.
4. Select Edit > Edit Alert.
5. Define the lifespan of the triggered alert record by setting the Expires field.
   Enter an integer and select a time unit from the dropdown. For example, to have all triggered alert records for this alert have a three-day lifespan, enter 3 and select day(s).
6. Click Save.