Alerting

User getting "Argument "action.email" is not supported by this handler" when creating alert

paimonsoror
Builder

I was wondering if anyone else has come across this problem? Seems to be affecting this one user. He is unable to schedule a report, or create an alert.

Scheduling a report doesn't pop any errors, but after he schedules, he can go back to the edit schedule screen, and it doesn't show that it has actually been scheduled.

When he goes to create an alert with an email, he gets the following error:

Argument "action.email" is not supported by this handler. 

and i see the following in the splunkd log, but nothing seems to come before/after to help

08-02-2017 15:57:07.026 -0400 ERROR AdminManager - Argument "action.email" is not supported by this handler.

It doesn't seem like other users are affected, and this user is in the appropriate 'power' group to be able to create alerts/schedule searches.

0 Karma
1 Solution

paimonsoror
Builder

Interesting. Not too sure this is the "answer", but a restart of the SH cluster seems to have fixed this.

View solution in original post

rodrigorsilva
Communicator

I had the same issue, in my case I solved after configure specific capabilities for this role.

edit_search_scheduler

I hope this will help.

Rodrigo Ribeiro

ghollmann
Engager

I know this post is old, but this just worked for me!

0 Karma

paimonsoror
Builder

Interesting. Not too sure this is the "answer", but a restart of the SH cluster seems to have fixed this.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...