UI fails to find Splunk Knowledge Objects, such as alerts or savedsearches

[sylim_splunk]

Some KOs are not found on the GUI > Settings > Searches, Reports and alerts > "search" with its name.

The version  we currently operate is 8.2.1 and SH Clustered. This happens quite frequently for mostly the alerts we make changes to the search strings.

[sylim_splunk · Accepted solution]

If you find some broken configs for the stanzas in savedsearches.conf, such as missing many fields or no 'search' field which will cause the KO to not show up in the search results on the GUI, you may hit a known issue for 8.2. Affected versions are 8.2.0 and 1. The fix is available from 8.2.2+.

Another symptom is, those affected KO/searches may not run as it is scheduled to run.

There is no workaround other than recreating the affected KO and consider to upgrade to 8.2.2+.

[sylim_splunk]

SPL-208206