We are seeing it also. Have you had any traction on this error? Are you using LDAP for authentication or a custom script of some sort?
@mgonter_splunk - any updates on this? i am using LDAP auth in a Search Head cluster.
actually to clarify, i was also seeing messages as found here in this question. this answer helped me (was actually a loadbalancing issue).
Sorry for the delay, my engineer was able to troubleshoot it and provided the following. Please take a look and compare..
Camilla Clone - Jeff
<input type="dropdown" token="card" searchWhenChanged="true"> <label>Select a User:</label> <search> <query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| stats values(CardholderName) as card | mvexpand card</query> </search> <fieldForLabel>card</fieldForLabel> <fieldForValue>card</fieldForValue> <choice value="*">All</choice> <default>*</default> <valueprefix>"CardholderName=</valueprefix> <valuesuffix>"</valuesuffix> </input> <panel> <title>$card$</title> <table> <search> <query>sourcetype="Camilla - All Events" $card$ Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description</query> <earliest></earliest> <latest></latest> </search> </table> </panel>
That thread mentions that the problem is resolved in 6.3.2, which we are running, but we're still seeing that error come up. There were other users in the thread that said the same. Is there a confirmation that it is now fixed in 6.3.3 or 6.3.4?
I have also faced this issue while back. After long struggle, figured out the issue is with F5 VIP settings.
please check "sessioncookieinsert' as the default persistence profile". Once we updated this setting above mentioned issue is gone.
I hope this helps you.