Alerts without results do not create incidents

[Stjubit]

It seems like Alert Manager is not able to open incidents for Splunk alerts that do not return results.

Example condition:

I can see that Splunk is able to create triggered alerts, but the alert manager action does not do anything. I also do not see any errors in the alert manager logs.

Example savedsearches.conf:

[Alert Manager Bug Test Alert]
action.alert_manager = 1
action.alert_manager.param.append_incident = 0
action.alert_manager.param.auto_previous_resolve = 0
action.alert_manager.param.auto_subsequent_resolve = 0
action.alert_manager.param.auto_suppress_resolve = 0
action.alert_manager.param.auto_ttl_resove = 0
action.alert_manager.param.title = Alert Manager Bug Test Alert
action.email.show_password = 1
alert.severity = 1
alert.suppress = 1
alert.suppress.period = 60s
alert.track = 1
counttype = number of events
cron_schedule = * * * * *
description = Alert Manager Bug Test Alert
dispatch.earliest_time = -15m
dispatch.latest_time = now
enableSched = 1
quantity = 1
relation = less than
search = index=_internal sourcetype=somethingthatdoesnotexist

~ Stjubit