If anyone is coming across this in 2022, you should know that there's a pretty easy workaround for this nowadays. The issue is with XML parsing, but Splunk allows you to output the results in JSON format with a simple change to your rest query. Instead of my query for lookup transforms: | rest /servicesNS/nobody/app/data/transforms/lookups splunk_server=local You just add the output_mode=json GET argument to it, like so: | rest /servicesNS/nobody/app/data/transforms/lookups output_mode=json splunk_server=local This resolved this issue for me immediately. ... View more

So, if I understand how sendemail works when SMTP auth is required, a user needs the "admin_all_objects" capability" in order to read auth_username and auth_password from alert_actions. This means regular users can't send email, as the credentials get passed to SMTP server with null values. These users generally see something like this: command="sendemail", Connection unexpectedly closed while sending mail to: somebody@something.com. Is this a feature or a bug?    ... View more

I ran across the same error. I believe it is related to an incomplete (timed out) bundle push. Error cluster-master : (/opt/splunk/var/log/splunk) splunk $ grep -i bundle splunkd.log 04-27-2018 16:05:30.747 +0000 WARN PeriodicReapingTimeout - Spent 18915ms reaping replicated bundles in $SPLUNK_HOME/var/run/searchpeers 04-27-2018 19:03:23.439 +0000 WARN PeriodicReapingTimeout - Spent 11606ms reaping replicated bundles in $SPLUNK_HOME/var/run/searchpeers 04-27-2018 19:03:56.354 +0000 WARN PeriodicReapingTimeout - Spent 14195ms reaping replicated bundles in $SPLUNK_HOME/var/run/searchpeers Doing the following (on the Cluster Master) resolved it: Restart CM splunk enable maintenance-mode (Optional: splunk show maintenance-mode) splunk restart splunk disable maintenance-mode Rolling Restart & Confirm splunk rolling-restart cluster-peers Wait 30 mins. (Time depends on the amount of indexers - this environment has 18) splunk show cluster-bundle-status Bundle Push If the peers are not all displaying the same active bundle, do a bundle push. splunk apply cluster-bundle (Wait 30 mins) splunk show cluster-bundle-status ... View more