Monitoring Splunk

MSSP reporting

666Meow
Explorer

Hi all,

I’ve recently encountered several challenges since migrating to Splunk Mission Control (MS) and would appreciate any guidance or insights.

Summary of Issues:

  • We had a dashboard set up to pull all the data needed for our monthly report. Since switching to MS, all those dashboards are broken with errors like:
    "Could not find object id="*.

  • I recreated the dashboard with new searches, which initially worked fine and allowed report creation. However, when revisiting the new dashboard, most searches now fail or return no results within the expected time frame, despite previously working and being used in the latest report.

  • Several items such as charts for "top hosts (consolidated)" and "top hosts" that were available under Security Domain > Network > Exec View are now missing post-migration.

Search Aborts and Resource Issues:

  • One major problem is searches being aborted with SVC errors. After contacting the customer, workload restrictions on my account were lifted, but searches still fail due to resource usage.

  • Even limiting searches to a single day results in failures, and this has become quite frustrating.

Example Problem with Macros and Searches:

  • The macro sim_licensing_summary_base appears to be missing since moving to MS, and even the customer cannot locate it.

  • The following search, intended to replicate the macro’s function, returns incomplete results after 2025-04-10 without any errors in the job manager:

     
    (host=*.*splunk*.* NOT host=sh*.*splunk*.* index=_telemetry source=*license_usage_summary.log* type="RolloverSummary") | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=true | eval GB=round((volume / 1073741824),3) | fields - b, volume | stats avg/max(GB)

Additional Notes:

  • We’ve also noticed missing dashboards and objects that were previously part of Enterprise Security views.

  • Searches aborting due to resource limits remain an issue despite workload adjustments.

Has anyone else experienced similar problems after switching to Mission Control? Any advice on troubleshooting these dashboard errors, missing macros, or search aborts would be greatly appreciated.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...