Splunk Enterprise Security
Highlighted

When creating ES rules I get this error - "Search could not be updated: Argument "schedule_priority" is not supported by this handler."

New Member

I cannot find any literature on it or an explanation. Does anybody recognize this and know how to remedy?

0 Karma
Highlighted

Re: When creating ES rules I get this error - "Search could not be updated: Argument "schedule_priority" is not supported by this handler."

Path Finder

i am also getting the same error while creating a correlation search. Infact i get the same error when i try to create an alert in Splunk enterprise suite.
I think it's because of some sort of issue with the Scheduler. Just thinking out loud.

0 Karma
Highlighted

Re: When creating ES rules I get this error - "Search could not be updated: Argument "schedule_priority" is not supported by this handler."

SplunkTrust
SplunkTrust

Whats your version of Splunk Core and ES?

0 Karma
Highlighted

Re: When creating ES rules I get this error - "Search could not be updated: Argument "schedule_priority" is not supported by this handler."

Path Finder

@lakshman239 I am running Splunk 7.2.1 with ES 5.2

0 Karma
Highlighted

Re: When creating ES rules I get this error - "Search could not be updated: Argument "schedule_priority" is not supported by this handler."

SplunkTrust
SplunkTrust

ok, I am on 7.0.3 with ES 5.1.1 still and don't see any issue. This comes from schedule_priority setting in the savedsearches.conf . Could you try the following?

  1. As admin user, can you try to edit (any dummy changes will do) any of the correlation searches that comes with ES? Are you seeing any errors when saving it?
  2. do the above step 1 as non-admin user and are you seeing any diff behaviour?

This could indicate any issues with permissions/roles/capabilities to user.

0 Karma