topic Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-for-Enterprise-Security-Why-loading-the-debug-refresh/m-p/184730#M883 <P>Any time I load the debug/refresh endpoint, correlation searches stop running. Or, at least, they stop producing notable events. Is this expected behavior and if not, what's going on?</P> <P>Splunk Enterprise 6.2.2, Splunk App for Enterprise Security 3.2.</P> Thu, 12 Mar 2015 17:50:15 GMT tkopchak 2015-03-12T17:50:15Z Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-for-Enterprise-Security-Why-loading-the-debug-refresh/m-p/184730#M883 <P>Any time I load the debug/refresh endpoint, correlation searches stop running. Or, at least, they stop producing notable events. Is this expected behavior and if not, what's going on?</P> <P>Splunk Enterprise 6.2.2, Splunk App for Enterprise Security 3.2.</P> Thu, 12 Mar 2015 17:50:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-for-Enterprise-Security-Why-loading-the-debug-refresh/m-p/184730#M883 tkopchak 2015-03-12T17:50:15Z Re: Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-for-Enterprise-Security-Why-loading-the-debug-refresh/m-p/184731#M884 <P>I don't know what is going on, but I see the same behavior on 6.1.6 and 3.1.1.</P> <P>Restarting Splunk on the ESS box fixes the glitch for me.</P> Thu, 26 Mar 2015 21:44:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-for-Enterprise-Security-Why-loading-the-debug-refresh/m-p/184731#M884 madcitygeek 2015-03-26T21:44:16Z