Splunk Enterprise Security
Highlighted

Error message Failed to sync collection and investigations

New Member

I am getting below error message.

2019-07-11 09:36:25,643+0000 ERROR pid=18084 tid=MainThread file=configurationcheck.py:run:228 | status="completed" task="confcheckessyncinvestigation_xrefs" message="Failed to sync xref collection and investigations: Could not get investigation notable xrefs"

I have single-instance environment with fresh installation of Splunk Enterprise 7.2.7 and ES 5.3.0. I excluded all add-on during ES installation.

Can you please explain why this error message is coming and is there any impact on Splunk or ES?

thanks in advance for your reply
Michal

0 Karma
Highlighted

Re: Error message Failed to sync collection and investigations

SplunkTrust
SplunkTrust

Pls check the health of the kvstore and may need a restart again.

0 Karma
Highlighted

Re: Error message Failed to sync collection and investigations

New Member

I've checked kvstore status by command:

./splunk show kvstore-status

Status is ready.

I am not sure how to check health of kvstore. You mean Monitoring console/Health check?

0 Karma
Highlighted

Re: Error message Failed to sync collection and investigations

New Member

I've solved it. 🙂 It is not right solution. I've reinstalled Splunk and ES. The error is gone.

0 Karma