Splunk Enterprise Security

Error while assigning/ updating notable events.

inayath_khanin
Explorer

Hi Folks,

I am getting below error in the incident review dashboard and this error is persistent impacting operations.

Error: only 0 events successfully updated. unable to edit all selected events due to the max events per bucket limit.

I tried increasing max_events_per_bucket to 2500 referring below link even though the issue is still persistent. 

https://docs.splunk.com/Documentation/ES/6.2.0/Admin/CustomizeIR

Please suggest.

Attached below screenshotCapture.PNG

Thanks in advance

 

haraksin
Path Finder

I am having this issue too - the docs aren't clear about what causes this error, as it's clearly not caused by hitting the event limit, at least not that I can see.

0 Karma

Nisha18789
Builder

Hello @inayath_khanin , you can use a smaller time range when reviewing notable events on Incident Review, which reduces the number of events on the Incident Review dashboard to less than 1000. 1000 is the default value of max_events_per_bucket 

for more details refer splunk documentation:

https://docs.splunk.com/Documentation/ES/6.2.0/Admin/CustomizeIR

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...