I'm trying to dynamically add risk modifiers with sendalert for Enterprise Security. The ad-hoc search works and adds risk modifier event, but the saved search fails with the below error. I raised dispatch.ttl by a large amount for testing. SEARCH: | from datamodel:Intrusion_Detection | search [| inputlookup internal_ip | rename ip as src] | get_asset(src) | eval risk_object_type=if(isnotnull(src_nt_host),"system","unmanged_system") | eval risk_score=if(risk_object_type="system",40,5) | eval risk_object=if(isnotnull(src_nt_host),src_nt_host,src) | sendalert risk ERROR: "sendmodalert - action=risk STDERR - ERROR: [Errno 2] No such file or directory: u'/opt/splunk/var/run/splunk/dispatch/scheduler***/results.csv.gz'" Any tips of where to turn from here? ... View more