Splunk for Enterprise Security: Why loading the de...

tkopchak · ‎03-12-2015

Any time I load the debug/refresh endpoint, correlation searches stop running. Or, at least, they stop producing notable events. Is this expected behavior and if not, what's going on?

Splunk Enterprise 6.2.2, Splunk App for Enterprise Security 3.2.

madcitygeek · ‎03-26-2015

I don't know what is going on, but I see the same behavior on 6.1.6 and 3.1.1.

Restarting Splunk on the ESS box fixes the glitch for me.

Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue

Request for Professional Development: Attending .conf26

Join the Conversation