Splunk Enterprise Security

Getting error when trying to update notables after upgrade from 5.0 to 5.1

jamesbrock
Path Finder

After upgrading to 5.1 (and 7.1.2) from 5.0 (and 7.0.2), we are noticing errors when trying to edit notables. Steps to reproduce this: select a notable on the incident review page, click edit, change some attributes or add a comment then click save. We will then receive a error at the top of the edit notable form. Has any one else seen this issue?

ERROR pid=5980 tid=MainThread file=notable_update_rest_handler.py:makeChanges:1159 | The update failed:ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13

Snip from the notable_update_rest_handler.log

2018-08-13 17:01:04,280+0000 ERROR pid=5980 tid=MainThread file=notable_update_rest_handler.py:makeChanges:1159 | The update failed:ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13
Traceback (most recent call last):
  File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 1110, in makeChanges
    session_key)
  File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 959, in setStatuses
    result = self.setStatusBySearchID(searchID, urgency, status, comment, newOwner, reviewTime, transitions, session_key, currentUser, force_refresh=False, rule_ids_to_change=ruleUIDs, existing_statuses=existing_statuses)
  File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 784, in setStatusBySearchID
    for event in dataset:
  File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\search\__init__.py", line 1568, in __iter__
    ((stop - __iteridx), len(__iterbuffer), localCount)
Exception: ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...