https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321134#M2958 <P>I cannot find any literature on it or an explanation. Does anybody recognize this and know how to remedy?</P> Fri, 19 Jan 2018 17:42:58 GMT bscavotto 2018-01-19T17:42:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321134#M2958 <P>I cannot find any literature on it or an explanation. Does anybody recognize this and know how to remedy?</P> Fri, 19 Jan 2018 17:42:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321134#M2958 bscavotto 2018-01-19T17:42:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321135#M2959 <P>i am also getting the same error while creating a correlation search. Infact i get the same error when i try to create an alert in Splunk enterprise suite. <BR /> I think it's because of some sort of issue with the Scheduler. Just thinking out loud.</P> Tue, 26 Mar 2019 09:24:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321135#M2959 qbolbk59 2019-03-26T09:24:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321136#M2960 <P>Whats your version of Splunk Core and ES?</P> Tue, 26 Mar 2019 09:59:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321136#M2960 lakshman239 2019-03-26T09:59:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321137#M2961 <P>@lakshman239 I am running Splunk 7.2.1 with ES 5.2</P> Tue, 26 Mar 2019 10:42:43 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321137#M2961 qbolbk59 2019-03-26T10:42:43Z https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321138#M2962 <P>ok, I am on 7.0.3 with ES 5.1.1 still and don't see any issue. This comes from schedule_priority setting in the savedsearches.conf . Could you try the following?</P> <OL> <LI>As admin user, can you try to edit (any dummy changes will do) any of the correlation searches that comes with ES? Are you seeing any errors when saving it?</LI> <LI>do the above step 1 as non-admin user and are you seeing any diff behaviour? </LI> </OL> <P>This could indicate any issues with permissions/roles/capabilities to user.</P> Tue, 26 Mar 2019 12:10:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/When-creating-ES-rules-I-get-this-error-quot-Search-could-not-be/m-p/321138#M2962 lakshman239 2019-03-26T12:10:14Z