Greetings Splunkers, I have a dashboard that "broke" over the weekend. When I run any of the dashboard searches I see errors of: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?count=0&all=true&earliest=-700d&latest=-2d&output_mode=xml from server=https://127.0.0.1:8089 - Bad Request Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?count=0&all=true&earliest=-700d&latest=-2d&output_mode=xml from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Learn More The REST request on the endpoint URI /services/storage/investigation/investigation?count=0&all=true&earliest=-700d&latest=-2d&output_mode=xml returned HTTP 'status not OK': code=400, Bad Request. Looking up similar questions here leads me to believe that it might be an issue with the REST api path for investigations. Does anyone know if there is a different path for investigations for ES 6.0.2? I am sure I am missing something simple so don't be afraid to "barney" style this. Other questions: https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-do-we-get-errors-on-the-REST-command-in-the-Investigation/m-p/470951
... View more