Splunk Enterprise Security

Why do we get errors on the REST command in the Investigation Overview dashboard on Splunk ES?

hettervik
Builder

Hi,

After upgrading to Splunk ES version 6.0.0 we got the Investigation Overview dashboard, but we have some problems when running it. If we try to look for investigations far back in time, the searches on the dashboard doesn't work, and they give an error. More specifically, the search | rest splunk_server=local count=0 /services/storage/investigation/investigation all=true earliest="-90d@d" latest="now" gives the error Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation [...] from server https://127.0.0.1:8089 [...]. Note, it works fine if we are not looking that far back, it only throws an error if we look for investigations older than a certain time. We don't know if it's the amount of time looking back itself, or if it is a certain investigation that causes the REST call to crash, but either way this looks like a bug to me.

Anyone else have experienced the same issue, or possible have a fix?

0 Karma

xori22
New Member

Hi stuck on the same issue here..

works fine for specific time but when we go far from 50 days~ it breaks

 

any help?

0 Karma

hettervik
Builder

We tried fixing the problem by deleting all investigations older than a certain date. This "solved" the problem for a time, but now the problem has reappeared. Again we can use the REST commando to look for investigations older than a certain date. We can't figure out why. It seems like a bug to us.

0 Karma

GDustin
Path Finder

Having the same problem, we can walk right up to 7 days then it starts bricking, it seemed to work fine right out of the box, at first then I think once we broke 7 days age it went away; 6.0.1

variations trying to inspect:

| `investigations` all=true earliest="-8d" latest="now"

Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?count=0&all=true&earliest=-8d&la... from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API.

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...