In my testing, you only needed to have the "list_settings" capability with a "user" role in order for this to work. (Using Splunk Cloud 7.2.9). See this link: https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Alert/Emailnotification This section: "Define an email notification for an alert or scheduled report" ... View more

Yes, I pasted the wrong one, and have fixed it. Thanks ... View more

From the Knowledge Manager Manual: "Splunk regular expressions are PCRE (Perl Compatible Regular Expressions) and use the PCRE C library." Link: http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions (Link updated) ... View more

I ran across the same error. I believe it is related to an incomplete (timed out) bundle push. Error cluster-master : (/opt/splunk/var/log/splunk) splunk $ grep -i bundle splunkd.log 04-27-2018 16:05:30.747 +0000 WARN PeriodicReapingTimeout - Spent 18915ms reaping replicated bundles in $SPLUNK_HOME/var/run/searchpeers 04-27-2018 19:03:23.439 +0000 WARN PeriodicReapingTimeout - Spent 11606ms reaping replicated bundles in $SPLUNK_HOME/var/run/searchpeers 04-27-2018 19:03:56.354 +0000 WARN PeriodicReapingTimeout - Spent 14195ms reaping replicated bundles in $SPLUNK_HOME/var/run/searchpeers Doing the following (on the Cluster Master) resolved it: Restart CM splunk enable maintenance-mode (Optional: splunk show maintenance-mode) splunk restart splunk disable maintenance-mode Rolling Restart & Confirm splunk rolling-restart cluster-peers Wait 30 mins. (Time depends on the amount of indexers - this environment has 18) splunk show cluster-bundle-status Bundle Push If the peers are not all displaying the same active bundle, do a bundle push. splunk apply cluster-bundle (Wait 30 mins) splunk show cluster-bundle-status ... View more