Splunk Enterprise Security

Why can't I see any items in Adaptive Response Actions and error "Notable Info could not be obtained: : undefined"?


Hi Splunker,

When creating or editing a new Correlation Search, the items of "Adaptive Response Actions" do not appear and the following error occurs.
The peculiarity only occurs when connecting from a macbook, and works normally when connecting from Windows.


The current environment is Splunk 9.0.5 + ES 7.1.1, but this has occurred since ES 7.x, a year ago.



0 Karma


This has been answered in https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-info-could-not-be-obtained-uniden...


The issue was related to KV store, while troubleshooting we found that the KV store status of starting hence we checked whether the cluster members are able to communicate to each other on KV port. Enabling the KV store port between all the cluster member resolved the issue.
0 Karma


Thanks for your answer.

I also saw the link you sent before, but in my case it is not a search head cluster environment.
My problem is that when I connect from the windows client, it works normally, but when I connect from the macbook, a problem occurs.
Of course kvstore is working normally.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...