When creating the collection definition in /opt/splunk/etc/apps/alert_manager/default/transforms.conf for the alert_manager splunk app, the author/s were not uniform in listing the fields for the 'drilldown_settings' collection, and that creates the error you're witnessing in your splunkd.log file.
To fix the issue, just put a space between the comman (,) and field name "label" in the fields_list parameter
ORIGINAL DEFINITION LOOKS AS FOLLOWS:
[drilldown_settings]
external_type = kvstore
collection = drilldown_settings
fields_list = _key, type*,label*, search, field, disabled, comment
AFTER EDITING THE DEFINITION, IT SHOULD LOOK AS FOLLOWS
[drilldown_settings]
external_type = kvstore
collection = drilldown_settings
fields_list = _key, type, label, search, field, disabled, comment
I hope that helps.
... View more