Splunk Enterprise Security

Splunk Enterprise Security: Why can't I create an ad-hoc notable event after upgrade?

abalogh_splunk
Splunk Employee
Splunk Employee

We have just upgraded Splunk Enterprise 6.4.1 / Splunk Enterprise Security 4.1.1 to Splunk Enterprise 6.5.2 with Splunk Enterprise Security 4.5.2.

When I try to create an Ad-Hoc Notable Event I get the following error in the UI:

Failed to create notable event: Not Found

Firefox Debug:
https://splunk-es/en-US/splunkd/__raw/services/alerts/modaction_adhoc [HTTP/1.1 404 Not Found 16ms]

0 Karma
1 Solution

abalogh_splunk
Splunk Employee
Splunk Employee

Answering my own question for documentation purposes.

Make sure you have upgrade Splunk_SA_CIM as well since modaction_adhoc has been moved into Splunk_SA_CIM in later versions. Former installation was running CIM 4.3.1, upgraded to 4.6.0 and it solved the issue.

View solution in original post

0 Karma

abalogh_splunk
Splunk Employee
Splunk Employee

Answering my own question for documentation purposes.

Make sure you have upgrade Splunk_SA_CIM as well since modaction_adhoc has been moved into Splunk_SA_CIM in later versions. Former installation was running CIM 4.3.1, upgraded to 4.6.0 and it solved the issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...