About matt_park

matt_park · ‎05-14-2019

What sort of authentication are you using? Seeing this with SSO/SAML and my suspicion is it might be a page element attempting to establish a new session (I could be wrong).

matt_park · ‎10-18-2017

I think I found the answer. In your Searches, reports, and alerts, go to Edit > Advanced Edit > change "alert_type" from "always" to "number of events". set "alert_comparator" to "greater than" set "alert_threshold" to "0" Save and schedule your search (if you haven't already). At this point, you should be able to click Edit and see "Edit Alert" and the saved search will show up under the Alerts filter at the top instead of Reports

matt_park · ‎01-18-2016

For those still experiencing the issue, make sure the case matches your current file. The download version (Option 2) is lowercase and should be Cookie.py instead of cookie.py. I moved my original version to a backup directory and then copied in the updated version (with the proper case), restarted the search head and it resolved the issue. As a temporary workaround, it seems using a private browsing session bypasses your cookies and should allow you to get a fully working interface.

Posts	3
Solutions	1
Karma Given	8
Karma Received	15
Member Since	‎10-22-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Why does my Splunk web keep auto-refreshing?

Re: Is there a way to convert a scheduled report t...

Re: After upgrading a search head cluster to Splun...