SPL Query:
index=_internal sourcetype=splunkd component=sendmodalert action=notable
Output:
10-27-2021 16:31:01.962 +0200 WARN sendmodalert - action=notable - Alert action script returned error code=3
10-27-2021 16:31:01.962 +0200 INFO sendmodalert - action=notable - Alert action script completed in duration=103 ms with exit code=3
10-27-2021 16:31:01.962 +0200 ERROR sendmodalert - action=notable STDERR - ERROR: [Errno 13] Permission denied
10-27-2021 16:31:01.858 +0200 INFO sendmodalert - Invoking modular alert action=notable for search="Threat - ....... - Rule" sid="......" in app="SplunkEnterpriseSecuritySuite" owner="......" type="saved"
Dear all,
does someone know why permissions are denied for creating notable events in Enterprise Security (6.4.1) after a correlation search is triggered? The owner of the search has an ess_admin role.
