https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208520#M60861 <P>My team and I are receiving an email for an alert that I set up. When I receive the email, there is a link to view the search and its results. The link works for me (as I created the search), but none of my teammates are able to resolve the URL properly.</P> <P>Error message:<BR /> The search you requested could not be found.</P> Mon, 01 Aug 2016 21:22:08 GMT kpyfan 2016-08-01T21:22:08Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208520#M60861 <P>My team and I are receiving an email for an alert that I set up. When I receive the email, there is a link to view the search and its results. The link works for me (as I created the search), but none of my teammates are able to resolve the URL properly.</P> <P>Error message:<BR /> The search you requested could not be found.</P> Mon, 01 Aug 2016 21:22:08 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208520#M60861 kpyfan 2016-08-01T21:22:08Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208521#M60862 <P>Did you grant permissions for other people to access the alert and the search, or are they still private to you? See <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/AlertPermissions">Alert permissions</A> in the <EM>Alerting Manual</EM>.</P> Mon, 01 Aug 2016 21:42:22 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208521#M60862 ChrisG 2016-08-01T21:42:22Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208522#M60863 <P>Yes, the alerts are all granted Read/Write for the app itself.</P> Mon, 01 Aug 2016 21:43:48 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208522#M60863 kpyfan 2016-08-01T21:43:48Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208523#M60864 <P>And the other people also have the right permissions to run the search itself? That is, can they run the search on its own, outside of clicking the link in the email? Just covering the basics here.</P> Mon, 01 Aug 2016 22:11:15 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208523#M60864 ChrisG 2016-08-01T22:11:15Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208524#M60865 <P>Yes, I've confirmed with others. I watched another person open the saved alert and open it in search as well. Additionally, clicking on the alert name in the email allows everyone to view the alert (and open in search from there), but the "View results" button does not work unless it's me.</P> <P>Is it possible that this is related to the email link format? Links are showing up as /en-us/app/$APP_NAME/@go?sid=scheduler__$USER. Seems like only $USER is able to use the link.</P> Tue, 29 Sep 2020 10:29:53 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208524#M60865 kpyfan 2020-09-29T10:29:53Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208525#M60866 <P>Hi @kpyfan,<BR /> A couple of troubleshooting questions:</P> <P>What software version are you using? I see your post is tagged "6.3.0"--could you confirm?</P> <P>Is the alert scheduled or real-time? </P> Mon, 01 Aug 2016 22:25:42 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208525#M60866 frobinson_splun 2016-08-01T22:25:42Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208526#M60867 <P>Splunk Enterprise 6.3.0.1, alert is scheduled.</P> Mon, 01 Aug 2016 22:27:39 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208526#M60867 kpyfan 2016-08-01T22:27:39Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208527#M60868 <P>Thank you for the update! I believe this is a known issue and it has been fixed as of 6.3.2. If you are able to upgrade, I think this will solve the problem.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/ReleaseNotes/6.3.2#Search.2C_saved_search.2C_alerting.2C_scheduling.2C_and_job_management_issues">http://docs.splunk.com/Documentation/Splunk/6.3.2/ReleaseNotes/6.3.2#Search.2C_saved_search.2C_alerting.2C_scheduling.2C_and_job_management_issues</A></P> <P>Issue SPL-108433</P> Mon, 01 Aug 2016 22:33:59 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208527#M60868 frobinson_splun 2016-08-01T22:33:59Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208528#M60869 <P>The defect summary (SPL-108433) is "Power user having read and write permissions for a saved search owned by an admin user is unable to view results from scheduled email," which sounds just like your issue.</P> Mon, 01 Aug 2016 22:35:22 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208528#M60869 ChrisG 2016-08-01T22:35:22Z https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208529#M60870 <P>Awesome, thanks for the help guys! We will work on getting upgraded!</P> Mon, 01 Aug 2016 22:38:22 GMT https://community.splunk.com/t5/Splunk-Search/When-my-team-and-I-receive-emails-for-an-alert-I-set-up-why-is/m-p/208529#M60870 kpyfan 2016-08-01T22:38:22Z