Troubleshoot the Splunk App for Content Packs
Use the following summaries as a guide for troubleshooting unexpected behavior.
Searches have stopped running and dashboards are not populating with new data
Problem
Content Pack searches have stopped running and dashboards are not populating with new data after upgrading Splunk App for Content Packs.
Cause
Splunk App for Content Packs version 2.0.0 and later ship with the saved searches of the content packs deactivated by default.
Solution
To activate the saved searches, refer to the Install and Configure documentation of the required content pack. While the current version of Splunk App for Content Packs has improved in-product experience, we strongly recommend reading the documentation carefully while planning for an upgrade to Splunk App for Content Pack 2.0 to avoid any negative impact on deployment.
The saved search status is not updated on the content pack tile after manually activating/deactivating one or more saved searches
Problem
After manually activating/deactivating one or more saved searches included in a content pack, the saved search status is not updated on the content pack tile.
Cause
The saved search status displayed on the content pack tile is updated by the itsi_content_packs_status_update
saved search. This saved search is executed every 30 mins.
Solution
You can manually run the itsi_content_packs_status_update
saved search or wait for 30 minutes to get saved searches status updated automatically on the content pack tile.
The green checkmark still displays on the content pack tile after deleting all knowledge objects included in a content pack
Problem
After deleting all knowledge objects included in a content pack, the green checkmark still displays on the content pack tile.
Cause
The status of the content pack tile, which determines whether a green checkmark displays, is updated by the itsi_content_packs_status_update
saved search. This saved search is executed every 30 mins.
Solution
You can can manually run the itsi_content_packs_status_update
saved search or wait for 30 mins for the status of the content pack tile to update.
Working with synthetic data |
This documentation applies to the following versions of Splunk® App for Content Packs: 2.2.0
Feedback submitted, thanks!