No new alerts in notable index, where I can start troubleshouting

[d4wc3k]

Hello All

I have problem with Splunk ES, today I've noticed that there is no new alert in Incident Review Panel.
I have checked notable index, and there is also no new alert.
The same situation in case of information in threat_activity index.

My humble question is where I can start investigate the issue, in my opinion it's problem with matching data against searches.

Thanks

BR
Dawid

[lakshman239]

Check for any unusual errors/warnings in index=_internal and index=_audit logs.
Take any correlation search that was working previously and re-run manually within the search in ES to see if that returns expected results.
Check if all your data sources are still feeding data, data model's are accelerated (check ES Data model audit).

[to4kawa]

I have checked notable index
@d4wc3k
maybe, this is that make the alert by yourself.