Splunk Search

Splunk Enterprise Security Content Management blank

adidibra
Engager

Hello,

I performed a "fresh" installation of ES 4.6.1 in a search head cluster through deployer. Splunk app version is 8.0.9. 

The apps for the ES were pulled from a repository solution to deployer and then pushed to the search cluster. When I try to open the content management it is stuck in blank and the Incident Review displaying "Operation Failed, Internal Error. __enter__" error.

Is there any log file I might check and permission I need to change a this behavior is quite strange?

Thank you in advance

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk 8.0.9 does not support ES 4.6.1.  That's an antique version of ES.  Try an older (unsupported) version of Splunk or a newer version of ES.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...