In the splunkd.log I am finding the following entry with noting related before or after: 04-13-2015 14:00:02.482 -0700 ERROR script - sid:scheduler__nmurphy__search__RMD5ada861e3c4e7d72f_at_1428958800_4 command="runshellscript", Script: D:\Program Files\Splunk\bin\scripts\alert_handler.py exited with status code: 1 In savedsearches.conf [Test Alert] action.email.reportServerEnabled = 0 action.email.useNSSubject = 1 action.script = 1 action.script.filename = alert_handler.py alert.digest_mode = 0 alert.severity = 2 alert.suppress = 0 alert.track = 1 counttype = number of events cron_schedule = 0 * * * * dispatch.earliest_time = -1h dispatch.latest_time = now enableSched = 1 quantity = 0 relation = greater than request.ui_dispatch_app = search request.ui_dispatch_view = search search = index=perfmon sourcetype="Perfmon:FreeDiskSpace" instance="C:" PercentFreeSpace<"75" | dedup host Also verified that run a script is enabled with alert_handler.py as filename Created the symbolic link per your instructions ... View more

Sorry there is no alert_manager.log in this location. There are 3 other logs: alert_manager_helpers_controller.log alert_manager_scheduler.log alert_manager_settings_controller.log ... View more