Splunk Enterprise Security

Enterprise Security: how long is a search accessible?

danielbb
Motivator

I try to assign an event to myself, but I get the following message -

-- Unable to change 1 events: The search is no longer accessible, please refresh and try editing the events again (1 event)

We see -

alt text

The notable event I'm trying to assign is barely one day old...

0 Karma

danielbb
Motivator

Any ideas about this one maybe?

0 Karma

danielbb
Motivator

When I assigned the incident quickly, all went well.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...