Splunk Enterprise Security Content Management blan...

adidibra · ‎08-05-2021

Hello,

I performed a "fresh" installation of ES 4.6.1 in a search head cluster through deployer. Splunk app version is 8.0.9.

The apps for the ES were pulled from a repository solution to deployer and then pushed to the search cluster. When I try to open the content management it is stuck in blank and the Incident Review displaying "Operation Failed, Internal Error. __enter__" error.

Is there any log file I might check and permission I need to change a this behavior is quite strange?

Thank you in advance

richgalloway · ‎08-05-2021

Splunk 8.0.9 does not support ES 4.6.1. That's an antique version of ES. Try an older (unsupported) version of Splunk or a newer version of ES.

---
If this reply helps you, Karma would be appreciated.

Splunk Enterprise Security Content Management blank

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers

Are you a member of the Splunk Community?

Splunk Enterprise Security Content Management blank

Index This | Why did the turkey cross the road?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Feel the Splunk Love: Real Stories from Real Customers