Splunk Enterprise Security

Splunk for Enterprise Security: Why do we get the UI message "The incident review lookup file is currently being edited"?

mzax
Splunk Employee
Splunk Employee

When we try to change the status and update a notable event from the Incident Review dashboard we are prompted with a banner stating
"The incident review lookup file is currently being edited, please wait a bit and re-submit your changes"

1 Solution

mzax
Splunk Employee
Splunk Employee

You are probably using NFS for the storage.
NFS needs to be configured with supports for file locks. Without file-locking support, this error will occur.
As well as ensure that the nfslockd process is up and running.

View solution in original post

mzax
Splunk Employee
Splunk Employee

You are probably using NFS for the storage.
NFS needs to be configured with supports for file locks. Without file-locking support, this error will occur.
As well as ensure that the nfslockd process is up and running.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...