Splunk Enterprise Security

Error while assigning/ updating notable events.

inayath_khanin
Explorer

Hi Folks,

I am getting below error in the incident review dashboard and this error is persistent impacting operations.

Error: only 0 events successfully updated. unable to edit all selected events due to the max events per bucket limit.

I tried increasing max_events_per_bucket to 2500 referring below link even though the issue is still persistent. 

https://docs.splunk.com/Documentation/ES/6.2.0/Admin/CustomizeIR

Please suggest.

Attached below screenshotCapture.PNG

Thanks in advance

 

haraksin
Path Finder

I am having this issue too - the docs aren't clear about what causes this error, as it's clearly not caused by hitting the event limit, at least not that I can see.

0 Karma

Nisha18789
Builder

Hello @inayath_khanin , you can use a smaller time range when reviewing notable events on Incident Review, which reduces the number of events on the Incident Review dashboard to less than 1000. 1000 is the default value of max_events_per_bucket 

for more details refer splunk documentation:

https://docs.splunk.com/Documentation/ES/6.2.0/Admin/CustomizeIR

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...