Dashboards & Visualizations

UI fails to find Splunk Knowledge Objects, such as alerts or savedsearches

sylim_splunk
Splunk Employee
Splunk Employee

Some KOs are not found on the GUI > Settings > Searches, Reports and alerts > "search" with its name.

The version  we currently operate is 8.2.1 and SH Clustered. This happens quite frequently for mostly the alerts we make changes to the search strings.

Labels (1)
Tags (2)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

If you find some broken configs for the stanzas in savedsearches.conf, such as missing many fields or no 'search' field which will cause the KO to not show up in the search results on the GUI, you may hit a known issue for 8.2. Affected versions are 8.2.0 and 1. The fix is available from 8.2.2+.

Another symptom is, those affected KO/searches may not run as it is scheduled to run.

There is no workaround other than recreating the affected KO and consider to upgrade to 8.2.2+.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

If you find some broken configs for the stanzas in savedsearches.conf, such as missing many fields or no 'search' field which will cause the KO to not show up in the search results on the GUI, you may hit a known issue for 8.2. Affected versions are 8.2.0 and 1. The fix is available from 8.2.2+.

Another symptom is, those affected KO/searches may not run as it is scheduled to run.

There is no workaround other than recreating the affected KO and consider to upgrade to 8.2.2+.

sylim_splunk
Splunk Employee
Splunk Employee

SPL-208206

Tags (1)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...