Splice v 1.3 IOC Alerts not showing in Dashboard Panel

[klaxdal]

First off - Love the APP !! Great work .

Everything was working fine up until a week ago - all of the IOC consumption panels populate , yet the IOC Alerts Panel has stopped showing any information , I have reviewed the logs and don't seem to see any errors.

Any ideas ? I suspect it may have to do with the summary index ? I am at a loss as to how to fix this ..any help would be appreciated.

Running Splunk 6.2.6 / CentOS 7

Thanks !

[cleroux_splunk · Accepted solution]

It's going complicated to troubleshoot. Maybe start by looking at IOC Consumption, are the IOCs still ingested, etc? If yes, can you find recent indicators (ex: via the exportcsv command for example). Are you reading IOCs from local directories or through a TAXII feed? Obviously something changed in your environment!

[klaxdal]

Thanks Cedric !

That was just the nudge I needed to fin the issue ... turns out the macros.conf was incorrect.

Kristofer