ES Investigation REST API Error

ctfletcher — Tue, 13 Jul 2021 15:53:46 GMT

Greetings Splunkers,

I have a dashboard that "broke" over the weekend. When I run any of the dashboard searches I see errors of:

Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?count=0&all=true&earliest=-700d&latest=-2d&output_mode=xml from server=https://127.0.0.1:8089 - Bad Request
Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?count=0&all=true&earliest=-700d&latest=-2d&output_mode=xml from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Learn More
The REST request on the endpoint URI /services/storage/investigation/investigation?count=0&all=true&earliest=-700d&latest=-2d&output_mode=xml returned HTTP 'status not OK': code=400, Bad Request.

Looking up similar questions here leads me to believe that it might be an issue with the REST api path for investigations. Does anyone know if there is a different path for investigations for ES 6.0.2? I am sure I am missing something simple so don't be afraid to "barney" style this.

Other questions:
https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-do-we-get-errors-on-the-REST-command-in-the-Investigation/m-p/470951

topic ES Investigation REST API Error in Splunk Enterprise Security