Splunk Enterprise Security

Help with ESS Incident Review "There was an error fetching related investigations"

dood9999
Explorer

Having issues with fetching investigations in incident review.

Investigation is added for the alert but when accessing the alert I get the error "There was an error fetching related investigations" under related investigations.

My assumption is that it is a permissions issue since admins are able to view it with no problems.

However it appears that all the permissions that are needed are in place.

Any help is greatly appreciated.


Follow up question - Is there a way to auto add notables to investigations that share the same artifacts?

Labels (3)
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...