Splunk Enterprise Security

Use "sendalert risk" from saved search fails

bowesmana
Champion

A saved search that ends with

| sendalert risk param._risk_score=risk_score

runs fine, but fails when run as a saved search with the error

Error in 'sendalert' command: Alert script returned error code 3.

and in search.log just before it shows

sendmodalert - action=risk STDERR -  ERROR: [Errno 2] No such file or directory: u'/opt/splunk/var/run/splunk/dispatch/scheduler__admin__XX/results.srs.gz'

Anyone run risk actions from saved searches successfully?

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!