Hello Simon.  Nothing that I tried helped me overcome this issue.    I posted the same question on Splunk Sub Reddit too - https://www.reddit.com/r/Splunk/comments/ixnexn/splunk_enterprise_error_in_handler_savedsearch/  I tried removing everything from Alert Actions conf file and reset permissions on the app directories. It did not help.  I tried reinstalling the apps that were removed to see if there was an errant token in one of the apps that was lingering. No luck there.  Only saving grace, this is all in a lab environment. I was able to rebuild the whole Splunk enterprise server and now everything is working with the same configuration.  Regards, Dan  ... View more

Just update your proxy details in splunk-launch.conf and also in the $Splunk_Home\etc\apps\splunk_app_cloudgateway\local\cloudgateway.conf and then restart splunk. This will take care of the error\issue. Tested ..!!! ... View more

Can you please let me know what was missing on the ADFS side? ... View more

That is strange, there must be something that is causeing it to fail in the syntax Is it possible to paste the exact search you are running? ... View more

I believe this app is dead because it is indeed not showing anything in splunk 7.3 ... View more

@srichansen I have tested with case() evaluation function and rangemap command that whether there are special characters in range label or not, the range value remains the same. PS: rangemap did not accept equal to character = . So makes me think, is it possible that the latency values were actually changing when you were trying to re-run the search with special characters in the range label? Please find a run any where example based on Splunk's _internal index for previous day data so that values do not change (I am using date_second as latency to get dummy data between 1-60 ) index=_internal sourcetype=splunkd log_level!="INFO" earliest=-1d@d latest=-0d@d-1s | stats min(date_second) as latency by component | rangemap field=latency "lt 10"=0-10 "gt 10 and lt.eq 30"=10-30 "gt 30 and lt.eq 45"=30-45 "gt 45 and lt.eq 60"=45-60 | rename range as rangeWithRangeMapAndAlphaCharacters | rangemap field=latency "<10"=0-10 ">10 & <30"=10-30 ">30 & <45"=30-45 ">45 & <60"=45-60 | rename range as rangeWithRangeMapAndSpecialCharacters | eval rangeWithCaseAndAlphaCharacters=case(latency<=10,"lt 10",latency>10 AND latency<=30,"gt 10 and lt.eq 30",latency>30 AND latency<=45,"gt 30 and lt.eq 45",latency>45 AND latency<=60,"gt 45 and lt.eq 60",true(),"None") | eval rangeWithCaseAndSpecialCharacters=case(latency<=10,"<10",latency>10 AND latency<=30,">10 & <=30",latency>30 AND latency<=45,">30 & <=45",latency>45 AND latency<=60,">45 & <=60",true(),"None") ... View more

@srichansen... Anytime! Glad it worked 🙂 ... View more

Yes, I had see the answers, but was hoping that it had since been solved. Thanks for the assistance! ... View more