Splunk Enterprise Security

Notable info could not be obtained: : unidentified in content management adaptive response actions?

bhsakarchourasi
Path Finder

Hi All,

we have newly installed ES cluster where we cannot see the any action populating in adaptive response. We tried installing ES on stand alone server it works fine. Below is the error we are getting. Splunk version is 8.2 and ES 7.0.2.

bhsakarchourasi_0-1679032105358.png

Thanks in advance

 

0 Karma
1 Solution

bhsakarchourasi
Path Finder

The issue was related to KV store, while troubleshooting we found that the KV store status of starting hence we checked whether the cluster members are able to communicate to each other on KV port. Enabling the KV store port between all the cluster member resolved the issue.

View solution in original post

0 Karma

bhsakarchourasi
Path Finder

Upgraded the ES version to 7.1 but still facing same issue, any reference would be very helpful.

Thanks.

0 Karma

bhsakarchourasi
Path Finder

The issue was related to KV store, while troubleshooting we found that the KV store status of starting hence we checked whether the cluster members are able to communicate to each other on KV port. Enabling the KV store port between all the cluster member resolved the issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...