I have some troubles with the option "action.email" in a saved search. I want to create a report with the Splunk API and set the available parameter "action.email" to "true" / "1" (because the default value is false).
I tried it like the below query, but it's not working as expected. After executing it's always the default value (false) and Splunk didn't changed it to "true" or "1":
In a second step I tried to edit the report directly in Splunk Web -> Search, Reports, and Alerts -> testReport -> Advanced Edit. But everytime after I saved the report with the new parameter "action.email = 1" it looks like Splunk is reseting this value back to "false".
In my behavior., Splunk only saves the value "true" consistent after I edited the savedsearches.conf file.