Notable Event Aggregation Policy Preview Fails to Load

Applicability

Description

Users may encounter a problem where the preview panel for a Notable Event Aggregation Policy (NEAP) fails to display any results, even though the underlying search successfully generates data. The preview panel appears empty, and no error message is presented in the ITSI user interface. 

Investigation

To determine if you are encountering this specific issue, follow these steps:

1. Reproduce the Issue: Follow the steps outlined in the Description section to access the Event iQ preview. If the preview area is blank, proceed to the next step.
2. Check Browser Console for Errors:
   • Open your browser's developer tools (usually by pressing F12 or right-clicking and selecting "Inspect" or "Inspect Element").
   • Navigate to the "Console" tab.
   • Look for JavaScript errors, particularly those indicating attempts to access properties or call methods on undefined variables. 
     • 
3. Verify Missing Fields in ML Search Results:
   • The preview UI expects certain fields to be present in the search results to populate the preview table. Common fields include: Title, Description, Count, and other attributes used for notable event display.
   • To confirm if fields are missing, you would typically need to inspect the raw search results generated. This might involve examining the job inspector or the underlying search query if accessible, and verifying the presence of the expected fields. If the search results lack one or more of these expected fields, it confirms the condition for this issue.

Resolution

This issue has been identified as a known issue related to the missing field values preview UI not gracefully handling missing fields in the data.

Recommended Solution: Upgrade your Splunk ITSI instance to ITSI 4.21.0 or a later version. This version includes a fix for the underlying UI rendering issue.