topic Error - In handler 'savedsearch': Expecting different token in Splunk Search

Error - In handler 'savedsearch': Expecting different token

dantembe — Mon, 21 Sep 2020 19:31:27 GMT

When I create an action or try to change the variables in any of alert actions for an alert, I end up with a message -

"In handler 'savedsearch': Expecting different token"

I cannot save any of the changes to the search. This seems to be a permissions issues but just not sure how to resolve. Any help is appreciated.

Re: Error - In handler 'savedsearch': Expecting different token

srichansen — Wed, 21 Oct 2020 13:18:57 GMT

Hi,

Did you manage to get this fixed?

I am also getting the same error and cant find a fix.

regards

Simon

Re: Error - In handler 'savedsearch': Expecting different token

dantembe — Wed, 21 Oct 2020 13:38:41 GMT

Hello Simon.

Nothing that I tried helped me overcome this issue.

I posted the same question on Splunk Sub Reddit too - https://www.reddit.com/r/Splunk/comments/ixnexn/splunk_enterprise_error_in_handler_savedsearch/

I tried removing everything from Alert Actions conf file and reset permissions on the app directories. It did not help.

I tried reinstalling the apps that were removed to see if there was an errant token in one of the apps that was lingering. No luck there.

Only saving grace, this is all in a lab environment. I was able to rebuild the whole Splunk enterprise server and now everything is working with the same configuration.

Regards,

Dan