Troubleshoot Splunk Asset and Risk Intelligence

To find troubleshooting steps for resolving issues you might face with Splunk Asset and Risk Intelligence, see the following list:

• User can't save filters
• The Network asset investigation page doesn't update records in the asset record panel
• User can't manage metrics, add exceptions, or create alerts
• There are missing icons on the Data source management page
• Welcome message continues to appear after dismissal
• User adds a data source but can't see any data

User can't save filters

Sometimes when a user can't save filters on the asset discovery pages, it's because they don't have the correct capability added to their role. To add the capability for saving filters to a user's role, complete the following steps:

1. In Splunk Asset and Risk Intelligence, select Admin and then Permission settings.
2. Select Add role capabilities.
3. Using the drop-down list, select the user's role that you want to edit.
4. Select the ari_save_filters capability.
5. Select Add.

You must have the ari_admin role to edit roles in Splunk Asset and Risk Intelligence.

For more details on roles and capabilities, see Set up roles and capabilities for Splunk Asset and Risk Intelligence.

The Network asset investigation page doesn't update records in the record panel

Sometimes while investigating an asset, you might notice that the record panel doesn't update on the Network asset investigation page. For example, you might notice that an IP address is out-of-date and that the latest IP address doesn't appear. The data source that provided the IP address might have a higher priority than other data sources. As a result, the data source might have stopped sending data, and other lower priority data sources are not overwriting the IP address with a newer IP address.

To resolve this issue, you can reassign data source priorities as needed by completing the following steps:

1. In Splunk Asset and Risk Intelligence, select Admin then Data sources and then Data source management.
2. In the Configured data sources table, locate the data source you want to prioritize.
3. Select the settings icon ( ) for that source.
4. Using the drop-down list in the Data source inventory priorities section, select the new priority level for the network inventory.
5. Select Update.

For more details on data source priorities, see Assign data source priorities in Splunk Asset and Risk Intelligence.

User can't manage metrics, add exceptions, or create alerts

Sometimes when a user can't manage metrics, add exceptions, or create alerts, it's because they don't have the correct capabilities added to their role. To add the capabilities for managing metrics to a user's role, complete the following steps:

1. In Splunk Asset and Risk Intelligence, select Admin and then Permission settings.
2. Select Add role capabilities.
3. Using the drop-down list, select the user's role that you want to edit.
4. Select the ari_manage_report_exceptions, ari_dashboard_add_alerts, ari_manage_posture_settings, and the ari_manage_metric_settings capabilities.
5. Select Add.

You must have the ari_admin role to edit roles in Splunk Asset and Risk Intelligence.

For more details on roles and capabilities, see Set up roles and capabilities for Splunk Asset and Risk Intelligence.

There are missing icons on the Data source management page

If there are no action icons on the Data source management page, you might not have the correct capability to manage data sources. To add the capability for managing data sources, complete the following steps:

1. In Splunk Asset and Risk Intelligence, select Admin and then Permission settings.
2. Select Add role capabilities.
3. Using the drop-down list, select the user's role that you want to edit.
4. Select the ari_manage_data_source_settings capability.
5. Select Add.

You must have the ari_admin role to edit roles in Splunk Asset and Risk Intelligence.

For more details on roles and capabilities, see Set up roles and capabilities for Splunk Asset and Risk Intelligence.

Welcome message continues to appear after dismissal

Sometimes the dialog box with the Splunk Asset and Risk Intelligence welcome message continues to appear even after selecting "Dismiss". This happens because new versions of the app often contain updated Javascript code and other files that your browser typically caches. To resolve this issue, you must clear your cache or run the bump command.

User adds a data source but can't see any data

Sometimes after adding a data source, you might not see any fields or values populated when validating the data source. There are several potential causes for this. To troubleshoot, complete the following checks:

Make sure the search time window captures the data

1. In Splunk Asset and Risk Intelligence, select Admin then Data sources and then Data source management.
2. In the Configured data sources table, locate the data source you want to modify.
3. Select the more icon ( ).
4. Select Validate data source.
5. Select a new time for the Search time window. A longer time frame captures more data.

Make sure the data source adheres to the correct field mapping

In Splunk Asset and Risk Intelligence, data sources must have a common set of field mappings across each of the inventories. Splunk Asset and Risk Intelligence automatically maps the fields in known data sources to the relevant inventories. However, you must map certain fields in custom data sources to the appropriate inventories. For example, the IP inventory captures all IP addresses associated with network assets. Data sources mapped to this inventory must contain the ari_ip field. See Data source field mapping reference.

Make sure the data source has a priority set for the correct inventory

1. In Splunk Asset and Risk Intelligence, select Admin then Data sources and then Data source management.
2. In the Configured data sources table, locate the data source you want to prioritize.
3. Select the settings icon ( ) for that source.
4. Using the drop-down lists in the Data source inventory priorities section, select the new priority level for the inventory you're validating. For example, if you're validating against an IP address inventory type, then the data source must have a priority set for the IP inventory.
5. Select Update.

For more details on data source priorities, see Assign data source priorities in Splunk Asset and Risk Intelligence.

Manually run a batched search by generating a source summary

If you added a batched data source, the source might not have generated the data yet, and validation will not work. Batched data sources run on a schedule, which is typically once per hour or once per day. You can run the search outside of its schedule by completing the following steps:

1. In Splunk Asset and Risk Intelligence, select Admin then Data sources and then Data source management.
2. In the Configured data sources table, locate the data source you want to run the event search for.
3. Select the search icon ( ) for that source.
4. Select Generate summary now in the Manage Event Search dialog box to run the batched search immediately.
5. Validate the source again by selecting the more icon ( ) and then Validate data source.