Hello Simon. Nothing that I tried helped me overcome this issue. I posted the same question on Splunk Sub Reddit too - https://www.reddit.com/r/Splunk/comments/ixnexn/splunk_enterprise_error_in_handler_savedsearch/ I tried removing everything from Alert Actions conf file and reset permissions on the app directories. It did not help. I tried reinstalling the apps that were removed to see if there was an errant token in one of the apps that was lingering. No luck there. Only saving grace, this is all in a lab environment. I was able to rebuild the whole Splunk enterprise server and now everything is working with the same configuration. Regards, Dan
... View more