- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was wondering if anyone else has come across this problem? Seems to be affecting this one user. He is unable to schedule a report, or create an alert.
Scheduling a report doesn't pop any errors, but after he schedules, he can go back to the edit schedule screen, and it doesn't show that it has actually been scheduled.
When he goes to create an alert with an email, he gets the following error:
Argument "action.email" is not supported by this handler.
and i see the following in the splunkd log, but nothing seems to come before/after to help
08-02-2017 15:57:07.026 -0400 ERROR AdminManager - Argument "action.email" is not supported by this handler.
It doesn't seem like other users are affected, and this user is in the appropriate 'power' group to be able to create alerts/schedule searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Interesting. Not too sure this is the "answer", but a restart of the SH cluster seems to have fixed this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had the same issue, in my case I solved after configure specific capabilities for this role.
edit_search_scheduler
I hope this will help.
Rodrigo Ribeiro
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I know this post is old, but this just worked for me!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Interesting. Not too sure this is the "answer", but a restart of the SH cluster seems to have fixed this.
