We are on 10.6.1 and have been creating rules and alerts (in the reporting engine). We normally pick our hybrid (logs) concentrator as the data source (on the alert). This was working fine...now all of a sudden we get a error message with the below. We do push to decoders, on our alerts.
Anyone know what could of changed? We've tried deleting the rule, alert and app rule yet this message still comes back. Not sure if the Data Source should be our Log Decoder, if that has any performance impact? If so, why havent we gotten this before?