You need to give your users the 'list_settings' capability; that was introduced in Splunk 6.6 part of Common Criteria  (ISO/IEC 15408) compliance, so alert-sending has access to SSL configurations. ... View more

What would appear to be happening here is that, though the necessary binaries for base64 are being replicated to the indexers in the replication bundle, they are not executing successfully. The app itself utilises splunklib (a version dated in 2014) and, as has already been said, is only supporting up to 6.3 officially. In other words, behavioral bets are kind of off. That said, I have successfully installed the app on the indexers of a test system running 6.5, and the search commands now operate as expected. It seems, when not distributed via bundle replication, this works in 6.5. ... View more