Splunk Enterprise Security

Getting error when trying to update notables after upgrade from 5.0 to 5.1

jamesbrock
Path Finder

After upgrading to 5.1 (and 7.1.2) from 5.0 (and 7.0.2), we are noticing errors when trying to edit notables. Steps to reproduce this: select a notable on the incident review page, click edit, change some attributes or add a comment then click save. We will then receive a error at the top of the edit notable form. Has any one else seen this issue?

ERROR pid=5980 tid=MainThread file=notable_update_rest_handler.py:makeChanges:1159 | The update failed:ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13

Snip from the notable_update_rest_handler.log

2018-08-13 17:01:04,280+0000 ERROR pid=5980 tid=MainThread file=notable_update_rest_handler.py:makeChanges:1159 | The update failed:ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13
Traceback (most recent call last):
  File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 1110, in makeChanges
    session_key)
  File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 959, in setStatuses
    result = self.setStatusBySearchID(searchID, urgency, status, comment, newOwner, reviewTime, transitions, session_key, currentUser, force_refresh=False, rule_ids_to_change=ruleUIDs, existing_statuses=existing_statuses)
  File "C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\bin\notable_update_rest_handler.py", line 784, in setStatusBySearchID
    for event in dataset:
  File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\search\__init__.py", line 1568, in __iter__
    ((stop - __iteridx), len(__iterbuffer), localCount)
Exception: ResultSet.__iter__ -- timed out while waiting on data; expected 13 events, only got 12; count=13
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...