topic Re: Failed to create a test incident in Splunk Mission Control

How do I resolve this error "failed to create a test incident"?

nembee — Wed, 14 Sep 2022 01:42:40 GMT

I've got this error when testing to create an incident.

Re: Failed to create a test incident

kavitav — Tue, 06 Sep 2022 15:32:37 GMT

Hi! Thanks for trying out the app! We are looking into the error now, just so I understand, is the user you are trying to assign here yourself? or is it another user who today has access to ES? Thanks!

Re: Failed to create a test incident

vthimmegowda — Tue, 06 Sep 2022 20:42:50 GMT

is that a valid user . Do u see this problem when u select other users like urself ?

Re: Failed to create a test incident

Anni — Tue, 13 Sep 2022 19:58:10 GMT

Hi @nembee

We haven't heard back from you in a week. Please let us know if you can answer the above questions. We would love to know more details so we can investigate on our end. Thanks!

Re: Failed to create a test incident

nembee — Wed, 14 Sep 2022 01:07:45 GMT

Yes, it is a valid user. It is from an AD group membership. When i select other users or local accounts, it is still the same. None of the users assignment work. Incident can't be created.

Re: Failed to create a test incident

nembee — Wed, 14 Sep 2022 01:09:06 GMT

Yes, i am trying to create a test incident and assigning it to myself. The user account is an account from AD group membership. The same error occurred if i select other users in the list including Splunk local accounts.

Re: Failed to create a test incident

nembee — Wed, 14 Sep 2022 01:09:55 GMT

Yes, already provided the response for the questions below.

Re: Failed to create a test incident

Anni — Wed, 14 Sep 2022 22:35:11 GMT

Thanks for the update! @nembee

If there's any more user config or AD information you could send, screenshots are helpful, please mention here or email us at: missioncontrol-preview@splunk.com

Edit: I'm curious, does the incident creation work if you leave the "Owner" field unassigned?

We are looking into this right now!

Re: Failed to create a test incident

nembee — Thu, 15 Sep 2022 01:31:38 GMT

if i leave the owner field unassigned, "incident created successfully". But the incident is not listed on the main page. It is empty.

Re: Failed to create a test incident

Anni — Thu, 15 Sep 2022 19:28:37 GMT

Thank you for the screenshot! My hypothesis is that your AD group does not contain the correct permissions to create or view a Mission Control incident.

Here's the link to our permissions documentation: https://docs.splunk.com/Documentation/MC/Preview/Detect/Permissions

If you have access to the AD group (for example LDAP), could you try adding the correct permission to your user?

Here's more documentation for managing groups in LDAP: https://docs.splunk.com/Documentation/Splunk/9.0.1/Security/MapLDAPgroupstoSplunkroles

If you want to create and view an incident with the incident type "Default" the user would at least need the role permission "mc_analyst_edit_default."

Please let me know if that helps to solve anything! Thank you.

Re: Failed to create a test incident

Anni — Fri, 16 Sep 2022 19:30:29 GMT

Hi @nembee! After discussing more with the engineering team, one workaround would be to add the mc_admin role if your user needs access all areas of Mission Control Preview.

We found that Mission Control Preview does not handle the admin_all_objects capability consistently, resulting in the ability to create an incident but not list or view it. A workaround to allow both creation and viewing is to assign the mc_admin role, or as I mentioned previously, the mc_analyst_all_edit role (as appropriate) to the user.

We will fix this issue in a future release. Thank you for your patience!