Splunk Enterprise

Enterprise Security: Security Posture Drilldown Error

FelixL
Loves-to-Learn Lots

Hello Community,

I have a problem with the lastest Enterprise Security Version.
In the Security Posture Dashboard, when I drilldown the Top Notable Events, the URL is returned correctly but one thing breaks the whole Drilldown. The URLEncode sometimes is applied twice. So instead of %20 replacing spaces in the rule name that was used in the drilldown instead the URL includes %2520.
This breaks the Drilldown and then shows all Rule Names instead.
The weirdest Part about it is that independent of the Rule Name clicked it sometimes works and sometimes doesn't. 
A Reload through the associated Button on the Incident Review Page also fixes the error but this is still a nuisance in the daily business.

I have searched the Web for similar experiences but haven't found anything:
My question is if anybody else has the same problem so I can make sure that this is not some error from local files (which I checked, but its always possible I missed something) but something thats broken by default.
Im not fond of changing anything in the deeper Code of Enterprise Security but if anybody has a solution to the problem I'd be glad!

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...