Splunk Search

Error - In handler 'savedsearch': Expecting different token

dantembe
Loves-to-Learn

When I create an action or try to change the variables in any of alert actions for an alert, I end up with a message - 

"In handler 'savedsearch': Expecting different token" 

I cannot save any of the changes to the search. This seems to be a permissions issues but just not sure how to resolve. Any help is appreciated. 

Labels (1)
0 Karma

dantembe
Loves-to-Learn

Hello Simon. 

Nothing that I tried helped me overcome this issue. 

 

I posted the same question on Splunk Sub Reddit too - https://www.reddit.com/r/Splunk/comments/ixnexn/splunk_enterprise_error_in_handler_savedsearch/ 

I tried removing everything from Alert Actions conf file and reset permissions on the app directories. It did not help. 

I tried reinstalling the apps that were removed to see if there was an errant token in one of the apps that was lingering. No luck there. 

Only saving grace, this is all in a lab environment. I was able to rebuild the whole Splunk enterprise server and now everything is working with the same configuration. 

Regards,

Dan 

0 Karma

srichansen
Path Finder

Hi,

Did you manage to get this fixed?

I am also getting the same error and cant find a fix.

 

regards

Simon

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...