Error - In handler 'savedsearch': Expecting different token

[dantembe]

When I create an action or try to change the variables in any of alert actions for an alert, I end up with a message - 

"In handler 'savedsearch': Expecting different token" 

I cannot save any of the changes to the search. This seems to be a permissions issues but just not sure how to resolve. Any help is appreciated. 

[dantembe]

Hello Simon. 

Nothing that I tried helped me overcome this issue. 

I posted the same question on Splunk Sub Reddit too - https://www.reddit.com/r/Splunk/comments/ixnexn/splunk_enterprise_error_in_handler_savedsearch/ 

I tried removing everything from Alert Actions conf file and reset permissions on the app directories. It did not help. 

I tried reinstalling the apps that were removed to see if there was an errant token in one of the apps that was lingering. No luck there. 

Only saving grace, this is all in a lab environment. I was able to rebuild the whole Splunk enterprise server and now everything is working with the same configuration. 

Regards,

Dan 

[srichansen]

Hi,

Did you manage to get this fixed?

I am also getting the same error and cant find a fix.

regards

Simon