Why are we getting "invalid syntax" errors using and referencing generated field extractions in our alert searches?

[pricea]

When creating alerts in Splunk, we are trying to use generated field extractions and referencing them within our alert queries. When running the query in Search, there is no error. However, when trying to set an alert for the same query, we receive an error in our logs, stating that the query is in an invalid syntax (looking for the error now, we have since turned those jobs off to clean up our logs).

Any ideas or solutions to this problem would be greatly appreciated! It sounds like I could put the regex into the query, but I'd like to avoid this.

[dolivasoh]

I would double check the permissions on the field extractions. The user you're running the scheduled search as which powers the alert much have read access to the extractions.