Splunk Enterprise Security

Enterprise Security: how long is a search accessible?

danielbb
Motivator

I try to assign an event to myself, but I get the following message -

-- Unable to change 1 events: The search is no longer accessible, please refresh and try editing the events again (1 event)

We see -

alt text

The notable event I'm trying to assign is barely one day old...

0 Karma

danielbb
Motivator

Any ideas about this one maybe?

0 Karma

danielbb
Motivator

When I assigned the incident quickly, all went well.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.