Splunk Enterprise Security

Why do we get errors on the REST command in the Investigation Overview dashboard on Splunk ES?

hettervik
Builder

Hi,

After upgrading to Splunk ES version 6.0.0 we got the Investigation Overview dashboard, but we have some problems when running it. If we try to look for investigations far back in time, the searches on the dashboard doesn't work, and they give an error. More specifically, the search | rest splunk_server=local count=0 /services/storage/investigation/investigation all=true earliest="-90d@d" latest="now" gives the error Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation [...] from server https://127.0.0.1:8089 [...]. Note, it works fine if we are not looking that far back, it only throws an error if we look for investigations older than a certain time. We don't know if it's the amount of time looking back itself, or if it is a certain investigation that causes the REST call to crash, but either way this looks like a bug to me.

Anyone else have experienced the same issue, or possible have a fix?

0 Karma

xori22
New Member

Hi stuck on the same issue here..

works fine for specific time but when we go far from 50 days~ it breaks

 

any help?

0 Karma

hettervik
Builder

We tried fixing the problem by deleting all investigations older than a certain date. This "solved" the problem for a time, but now the problem has reappeared. Again we can use the REST commando to look for investigations older than a certain date. We can't figure out why. It seems like a bug to us.

0 Karma

GDustin
Path Finder

Having the same problem, we can walk right up to 7 days then it starts bricking, it seemed to work fine right out of the box, at first then I think once we broke 7 days age it went away; 6.0.1

variations trying to inspect:

| `investigations` all=true earliest="-8d" latest="now"

Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?count=0&all=true&earliest=-8d&la... from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API.

 

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...