Splunk Enterprise Security

Enterprise Security 4.0: Why am I unable to create a new investigation from the My Investigation tab with error "Timeline could not be saved"?

Anttman
New Member

When I am logged into Splunk Enterprise Security 4.0 as a user with the "admin" role, "ess_analyst", or "ess_admin" (all three have been assigned the "edit_timeline" role via the ES 4.0 permissions management page):
• I cannot create a new investigation from the My Investigation tab. Error: “Timeline could not be saved”
• However, notes can be saved, edited and removed from “Create New Entry” (top right) within My Investigations, but will not add to a current investigation entry

When I log in using the built-in admin (default) I am able to create a new investigation from the My Investigation tab. I verified permissions and need help determining what is missing in rights/permissions/configuration. Everyone who logs in to the search head has the same error within Enterprise 4.0.

Log files:
The investigative_canvas_controller.log file in the _internal index has the following error:

2015-11-11 13:36:59,469 ERROR InvestigativeCanvas - action=create; status=500; success=False; canvas_id=; user=user.name; message="There was an issue attempting to create the canvas";

The splunkd.log in the _internal index has the following error:

11-11-2015 13:36:59.467 -0500 ERROR KVStorageProvider - An error occurred during the last operation ('insertData', domain: '8', code: '18'): A document was corrupt or contained invalid characters . or $
0 Karma

LukeMurphey
Champion

This is bug (SOLNESS-7989 for reference). We already have it fixed in development and the fix will be available in a maintenance release.

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...