Troubleshoot the Splunk App for Content Packs

Use the following summaries as a guide for troubleshooting unexpected behavior.

Searches have stopped running and dashboards are not populating with new data

Problem

Content Pack searches have stopped running and dashboards are not populating with new data after upgrading Splunk App for Content Packs.

Cause

Splunk App for Content Packs version 2.0.0 and later ship with the saved searches of the content packs deactivated by default.

Solution

To activate the saved searches, refer to the Install and Configure documentation of the required content pack. While the current version of Splunk App for Content Packs has improved in-product experience, we strongly recommend reading the documentation carefully while planning for an upgrade to Splunk App for Content Pack 2.0 to avoid any negative impact on deployment.

The saved search status is not updated on the content pack tile after manually activating/deactivating one or more saved searches

Problem

After manually activating/deactivating one or more saved searches included in a content pack, the saved search status is not updated on the content pack tile.

Cause

The saved search status displayed on the content pack tile is updated by the itsi_content_packs_status_update saved search. This saved search is executed every 30 mins.

Solution

You can manually run the itsi_content_packs_status_update saved search or wait for 30 minutes to get saved searches status updated automatically on the content pack tile.

The green checkmark still displays on the content pack tile after deleting all knowledge objects included in a content pack

Problem

After deleting all knowledge objects included in a content pack, the green checkmark still displays on the content pack tile.

Cause

The status of the content pack tile, which determines whether a green checkmark displays, is updated by the itsi_content_packs_status_update saved search. This saved search is executed every 30 mins.

Solution

You can can manually run the itsi_content_packs_status_update saved search or wait for 30 mins for the status of the content pack tile to update.