Dashboards & Visualizations

UI fails to find Splunk Knowledge Objects, such as alerts or savedsearches

sylim_splunk
Splunk Employee
Splunk Employee

Some KOs are not found on the GUI > Settings > Searches, Reports and alerts > "search" with its name.

The version  we currently operate is 8.2.1 and SH Clustered. This happens quite frequently for mostly the alerts we make changes to the search strings.

Labels (1)
Tags (2)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

If you find some broken configs for the stanzas in savedsearches.conf, such as missing many fields or no 'search' field which will cause the KO to not show up in the search results on the GUI, you may hit a known issue for 8.2. Affected versions are 8.2.0 and 1. The fix is available from 8.2.2+.

Another symptom is, those affected KO/searches may not run as it is scheduled to run.

There is no workaround other than recreating the affected KO and consider to upgrade to 8.2.2+.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

If you find some broken configs for the stanzas in savedsearches.conf, such as missing many fields or no 'search' field which will cause the KO to not show up in the search results on the GUI, you may hit a known issue for 8.2. Affected versions are 8.2.0 and 1. The fix is available from 8.2.2+.

Another symptom is, those affected KO/searches may not run as it is scheduled to run.

There is no workaround other than recreating the affected KO and consider to upgrade to 8.2.2+.

sylim_splunk
Splunk Employee
Splunk Employee

SPL-208206

Tags (1)
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...