Splunk Enterprise

In handler 'savedsearch': Data could not be written: /nobody/search/savedsearches/SplunkOnlyAlert/search: host="usoms0090" while changing permissions for an alert

skladstrup
New Member

We just stood up a new Splunk Light instance, version 7.2.0. I created a search and then saved it as an alert. When I try to change it to anything aside from private, I get the following error message:

In handler 'savedsearch': Data could not be written:
/nobody/search/savedsearches/SplunkOnlyAlert/search:
host="usoms0090"

The host is the same as the Splunk instance itself.

Any suggestions on how to fix this issue?

Labels (1)
Tags (1)
0 Karma

_Tom
Explorer

This might be caused by files which are not owned by the splunk user. 
For instance, if this applies to local.meta, you will get an error that metadata can not be written.

0 Karma

tusharbalar
Engager

when I change permission to Private, It works for me. Don't know why.
Hope It will help you.

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...