Stuck at Analytics Story Onboarding Assistant in Splunk ES Content Update (Splunk Cloud)

[azer271]

The Analytics Story Onboarding Assistant keeps on displaying "0% uploaded" everytime I press enable the rules (using splunk cloud sc_admin account). Does anyone know why this is happening? Thanks!

Steps to reproduce:

1. In Onboarding (Preview), Select any stories such as active directory

2. Select any detections

3. Press Next

4. Press Enable

5. 0% uploaded forever

6. It said "You can close this window." but no rules are enabled in content management. 

Its empty. Please help. Thanks.

I will use these rules as an example. these rules are off, but they should be enabled in step 5.

[livehybrid]

Hi @azer271 

Can you open the network tab of developer tools in your browser and when you click it see what network requests are made and if any of these return any errors? It would be good to know if these requests come back with a positive response or if there is an error with some more information .

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[azer271]

It's all 200 status.

However, 99+ error messages appeared in developer tools when I pressed Enable. (mostly mentioning that the error is in es cloud url/static/@xxxx/app/DA-ESS-ContentUpdate/pages/onboarding.js)

Errors:

Error enabling saved search: TypeError: can't access property "split", document.cookie.split(...).find(...) is undefined
Error enabling saved search: TypeError: can't access property "split" of undefined
Cookie “splunkweb_csrf_token_8443” has been rejected because its expiration date is over the limit.

Thanks.