After upgrading to 5.1 (and 7.1.2) from 5.0 (and 7.0.2), we are noticing errors when trying to edit notables. Steps to reproduce this: select a notable on the incident review page, click edit, change some attributes or add a comment then click save. We will then receive a error at the top of the edit notable form. Has any one else seen this issue?
ERROR pid=5980 tid=MainThread file=notable_update_rest_handler.py:makeChanges:1159 | The update failed:ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13
Snip from the notable_update_rest_handler.log
2018-08-13 17:01:04,280+0000 ERROR pid=5980 tid=MainThread file=notable_update_rest_handler.py:makeChanges:1159 | The update failed:ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 1110, in makeChanges
session_key)
File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 959, in setStatuses
result = self.setStatusBySearchID(searchID, urgency, status, comment, newOwner, reviewTime, transitions, session_key, currentUser, force_refresh=False, rule_ids_to_change=ruleUIDs, existing_statuses=existing_statuses)
File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 784, in setStatusBySearchID
for event in dataset:
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\search\__init__.py", line 1568, in __iter__
((stop - __iteridx), len(__iterbuffer), localCount)
Exception: ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13
