@snethala_splunk Thankyou, I had to struggle a lot before getting to this, You can simply change sender's email address in below configuration and it worked for me.  /splunk/etc/system/local/alert_actions.conf [email] mailserver = localhost pdf.header_left = none pdf.header_right = none from = Splunk@companyname.com Before making config changes, you can test it out first to see its a valid email/company domain combination, <your Search>| sendemail to= <your email>  from= Splunk@companyname.com ... View more

I was getting the same error but changing record_count from 3000 to 1000 fixed the issue for me. ... View more

issue resolved when I used checkpoint parameter name in lowercase. ... View more

sc_admin worked for me ... View more

Hi @Damien_Dallimor , @jatin_patel , I'm doing just like you suggested, defined my function 'testid()'  in tokens.py and responsehandlers.py  scenario: created a function to read a value from csv file(which is being updated constantly with the last logged AuditId in splunk) and return the value after incrementing. Tokens.py ---> import csv def xyz(): with open('abc.csv', 'r') as f: csv_f=csv.DictReader(f) for row in csv_f: x=int(row['AuditId']) return(str(x+1)) responsehandlers.py ----> class Mytestclass: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint): print_xml_stream(raw_response_output) with open('abc.csv','r') as f: csv_f = csv.DictReader(f) for row in csv_f: x=int(row['AuditId']) if not "params" in req_args: req_args["params"]= {} req_args["params"]["testid"]=str(x+1)   However, I'm still facing some issues, 1. Every event is being logged twice. 2. Some AuditId's are missing. 3.  empty events are getting created with 0 return records. ... View more