We ran into the following error after creating two saved searches. We have 3 searchheads and 2 indexers.
searchhead's splunkd.log:
09-06-2017 10:48:42.891 -0400 ERROR SHCMaster - error accessing uri=https://**serverip**:8089/servicesNS/**userid**/**appname**/saved/searches/**searchname**/remove_suppression?output_mode=json, statusCode=502, description=Bad Request
I substituted our internal info with the placeholders (in bold).
The searches didn't produce the alerts. I cloned them and the cloned searches worked.
What could have caused this?
Thank you.
↧