Since the upgrade to 6.0, including 6.0.1, the dashboards are more often not working than working for me. In particular, the All Incidents dashboard seems to randomly stop being populated with data. For example, yesterday there's no information between 12pm and 6pm, and then today from 2am to 6am. I can confirm that there are incident type logs coming in the entire time, and that they are being parsed correctly. Data models are 100% and accelerated. During these gaps, the User Behavior dashboard also doesn't work. As for other issues, the File Activity dashboard is always on "Waiting for data...", Endpoint and Firewall config is no results found, web activity is only loading Top Referrers and Methods over Time. GlobalProtect, Firewall System and Real-Time seem to be working without an issue. As stated before, the events are being tagged and parsed into the different event types fine. I'm just not sure where else to look. ... View more

When I attempt to search for a user I get the error "Error in 'TsidxStats': WHERE clause is not an exact query." Our user's come from the pan in the form domain\username. The other search fields appear to work fine. If related, traffic and data events are at 0 as well. I upgraded to 6.0 from 5.4 by straight upgrading, by "Install from file" and then did a fresh reinstall as well (was fixing other issues). ... View more

I'm unable to search a user as I get "Error in TsidsStates: WHERE clause is not an exact query". I have tried straight upgrading the app, upgrade via overwriting, upgrade via GUI via Splunkbase and via file upload, and then a clean install. The other search boxes appear to work. ... View more