Solution: Splunk Enterprise Security (ES) incident review not showing notables or Splunk core settings issue

[splunkreal]

Hello,

if you have these errors while loading Incident review and you are behing haproxy server, probably there is a misconfiguration.

Possible web errors:

Error loading some filters

Updating...

Waiting for data...

[splunkreal · Accepted solution]

Try connecting directly to one of your search heads (through ssh tunnel if needed) and see if IR is showing now and investigate your haproxy.conf