Unable to select routing key or api key in Splunk On-Call app alert actions.

Available Languages

Updated:September 29, 2026
Document ID:SPLK046979

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk On-Call

Description

This problem is evident when a user is trying to configure alert actions and they see a message on the action which states, "Could not create search." Then when looking at the tooltip it will say, "Please specify a time range instead of using All Time." 

admissionruleerror.png 

This message can appear due to an admission rule in Splunk which is blocking all time searches. The Splunk On-Call app needs to make an all-time search to determine available routing keys and api keys for the Splunk On-Call instance.


Investigation

If a tooltip message appears like described, check if there are any admission rules blocking all time searches.


Resolution

Edit the admission rule as applicable for your configuration. Some options include excluding the Splunk On-Call app or particular user permissions.


Splunk On-Call App

Admission Rules Doc

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Articles