Splunk Enterprise Security

Notable info could not be obtained: : unidentified in content management adaptive response actions?

bhsakarchourasi
Path Finder

Hi All,

we have newly installed ES cluster where we cannot see the any action populating in adaptive response. We tried installing ES on stand alone server it works fine. Below is the error we are getting. Splunk version is 8.2 and ES 7.0.2.

bhsakarchourasi_0-1679032105358.png

Thanks in advance

 

0 Karma
1 Solution

bhsakarchourasi
Path Finder

The issue was related to KV store, while troubleshooting we found that the KV store status of starting hence we checked whether the cluster members are able to communicate to each other on KV port. Enabling the KV store port between all the cluster member resolved the issue.

View solution in original post

0 Karma

bhsakarchourasi
Path Finder

Upgraded the ES version to 7.1 but still facing same issue, any reference would be very helpful.

Thanks.

0 Karma

bhsakarchourasi
Path Finder

The issue was related to KV store, while troubleshooting we found that the KV store status of starting hence we checked whether the cluster members are able to communicate to each other on KV port. Enabling the KV store port between all the cluster member resolved the issue.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...