For future reference, the alert did not specify an index so I rectified this. However, this did not solve the problem. As mentioned, I could clone the alert and this would run fine. I could also then change the ownership of the cloned alert to "nobody" and it would also run fine. I wasn't content with this solution though, as centrally deployed configuration is strongly preferred to local changes in my environment. I've ended up deploying from SHC Deployer, making a simple local change (i.e. disabling), then undoing this local change (so, re-enabling) in order that no significant local change continues to exist. Doing this, I find the alert runs fine. Weird.
... View more