Splunk for Enterprise Security: Why loading the de...

tkopchak · ‎03-12-2015

Any time I load the debug/refresh endpoint, correlation searches stop running. Or, at least, they stop producing notable events. Is this expected behavior and if not, what's going on?

Splunk Enterprise 6.2.2, Splunk App for Enterprise Security 3.2.

madcitygeek · ‎03-26-2015

I don't know what is going on, but I see the same behavior on 6.1.6 and 3.1.1.

Restarting Splunk on the ESS box fixes the glitch for me.

Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Free Professional Services for .conf26 Attendees

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Join the Conversation