I have an alert with a "Send email" trigger action when the number of results is greater than zero. The aim is to send a table of results inline in the email. This isn't currently working - no email is being received when there are valid qualifying events in the search period (previous day). The alert was deployed using the SHC deployer, and is owned by "nobody". If I "Open in Search" I see results. If I clone the alert so a local version is run under my user context, I get the alert email sent.   Looking into _internal events, I can see that when the "nobody" search runs, no results are returned, and hence no email is sent - this isn't an issue with email configuration. Why does this search in this context give me no results? ... View more

I have a new UF installation and wish to register it with an existing Deployment Server. When I run the command: $SPLUNK_HOME/bin/splunk set deploy-poll <FQDN of DS>:<management port> I am prompted to login, and provide it with credentials that I am able to log into the DS Web interface. It gives me "Login failed" though.  How can I diagnose this further? ... View more