remote report/alert sends email

[gitingua]

Deleted the schedule report/alert. 
They keep sending letters to the post office. They are not in the system. empty reports come from deleted scheduled reports. 

Thanks

[richgalloway]

How did you delete the alert?  If you edited savedsearches.conf then did you also restart Splunk?

If you have multiple Splunk instances did you remove the alert from all of them?

[gitingua]

@richgalloway Searches, reports, and alerts -> my alert/report -> edit -> delete

checked in savedsearches.conf file, there they are also absent. they are absent at all. 

[diogofgm]

which savedsearches.conf have you checked? There can be multiple savedsearches.conf files depending on the app context and on the permissions set. Have you tried running a btool?

./splunk btool savedsearches list --debug | grep <the info your looking for>

[gitingua]

today also received a message from a remote scheduled report.

but deleted already as 2-3 weeks ago

[gitingua]

Nothing found

[richgalloway]

Is it possible someone cloned the alert and that clone is sending the emails? Try searching savedsearches.conf for the email address.

[gitingua]

@richgalloway he is nowhere to be found

[richgalloway]

Have you tried restarting Splunk?  It shouldn't be necessary, but perhaps it will help.

[gitingua]

@richgalloway tried it, didn't help

[gitingua]

@richgalloway But messages with reports come to the mail