This is so helpful. We recently installed ITSI which caused us to go over new quote limits |rest /servicesNS/-/-/saved/searches | search disabled=0 is_scheduled=1 | table title cron_schedule next_scheduled_time |convert mktime(next_scheduled_time) AS next_schedhuled_time_epoc timeformat="%F %T %Z" | where now()>next_schedhuled_time_epoc We used this to detect any searches that have gone stale ... View more

I had the exact same error on a linux box. The issue was a file permissions issue where the current user had read access but not write access to $Splunk_home\var\run\splunk\deploy Looks like this could be possibly related. ... View more

Its a search macro that I have created. ... View more