topic UI fails to find Splunk Knowledge Objects, such as alerts or savedsearches in Dashboards & Visualizations

UI fails to find Splunk Knowledge Objects, such as alerts or savedsearches

sylim_splunk — Tue, 06 Sep 2022 18:56:04 GMT

Some KOs are not found on the GUI > Settings > Searches, Reports and alerts > "search" with its name.

The version we currently operate is 8.2.1 and SH Clustered. This happens quite frequently for mostly the alerts we make changes to the search strings.

Re: UI fails to find splunk Knowledge Objects, such as alerts or savedsearches

sylim_splunk — Tue, 06 Sep 2022 18:26:19 GMT

If you find some broken configs for the stanzas in savedsearches.conf, such as missing many fields or no 'search' field which will cause the KO to not show up in the search results on the GUI, you may hit a known issue for 8.2. Affected versions are 8.2.0 and 1. The fix is available from 8.2.2+.

Another symptom is, those affected KO/searches may not run as it is scheduled to run.

There is no workaround other than recreating the affected KO and consider to upgrade to 8.2.2+.

Re: UI fails to find splunk Knowledge Objects, such as alerts or savedsearches

sylim_splunk — Tue, 29 Nov 2022 19:24:13 GMT

SPL-208206