Merge branch 'version_1231' into testing

docs/releasenotes.rst

@@ -19,6 +19,7 @@ https://trackme.readthedocs.io/en/latest/configuration.html
 - Fix - Issue #217 - Activity alerts view results link would result to 404 page not found for out of the box alerts
 - Fix - Issue #218 - Data sampling - creating custom rule from main then clicking on back leads to wrong window
 - Fix - Issue #219 - Outliers detection - dropdown for alert on upper is not pref-filled with the actual setting of the entity
+- Fix - Issue #220 - Audit scheduling - in some environments, status=success is replaced it search time by completed (internal scheduler) which is not expected by the searches
 - Change: Icons change
 
 Version 1.2.30

trackme/default/data/ui/views/trackMe_internal_scheduling.xml

@@ -135,7 +135,7 @@
                 <search>
                     <query>(index=_internal sourcetype=scheduler app="trackme")
 | eval alert_actions=if((isnull(alert_actions) OR (alert_actions == "")),"none",alert_actions)
-| eval status=case(status=="success", "completed", status=="skipped", "skipped", status=="continued", "deferred")
+| eval status=case(status=="success" OR status=="completed", "completed", status=="skipped", "skipped", status=="continued", "deferred")
 | search (status="completed" OR status="deferred" OR status="skipped")
 | stats count by status
 | sort - count
@@ -153,7 +153,7 @@
             <chart>
                 <search>
                     <query>(index=_internal sourcetype=scheduler app="trackme")
-| eval status=case(status=="success", "completed", status=="skipped", "skipped", status=="continued", "deferred")
+| eval status=case(status=="success" OR status=="completed", "completed", status=="skipped", "skipped", status=="continued", "deferred")
 | eval alert_actions = if(isnull(alert_actions) OR alert_actions == "", "none", alert_actions)
 | search (status="completed" OR status="deferred" OR status="skipped")
 | timechart partial=f count by status</query>