Applicability

Description

When navigating to the Analyst Queue within Splunk Enterprise Security, to view the default Analyst Queue, the "This queue does not exist" error is displayed as shown in the screenshot below.
 

Investigation

When reviewing a HAR of the attempt to load the Analyst Queue there are no errors displayed. Additionally the "aq" endpoint and "results" endpoint both appear as successful with the expected data returned. Despite this all users continued to see the error. Clearing the browser cache and cookies, and using different browsers, did not change the behavior either.

Resolution

Option 1 Curl - Preferred Method

Please be sure to substitute the <STACK_URL> and <YOUR_AUTH_TOKEN> values within the example Curl commands.

1. Run the Following Curl command to make the modinput executable:
   

   curl --location --request POST 'https://<STACK_URL>:8089/servicesNS/nobody/missioncontrol/configs/conf-mc_setup_task/mc_setup_task%3A%2F%2Fsystem_default_queue_setup_handler?output_mode=json' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --header 'Authorization: <YOUR_AUTH_TOKEN>' \
   --data-urlencode 'status=not_started' \
   --data-urlencode 'retries_completed=0'

2. Run the following Curl command to enable the modinput:
   

   curl --location --request POST 'http://<STACK_URL>:8089/servicesNS/nobody/missioncontrol/data/inputs/mc_setup_task/system_default_queue_setup_handler/enable?output_mode=json' \
   --header 'Authorization: <YOUR_AUTH_TOKEN>'

3. Run the following Curl command to invalidate the current cache, but if this fails you can wait ~5minutes for the process to run naturally:
   

   curl --location --request POST 'http://<STACK_URL>:8089/servicesNS/nobody/missioncontrol/v1/_cache/invalidate' \
   --header 'Authorization: <YOUR_AUTH_TOKEN>'

Option 2 SPL

This method is not preferred as it will not maintain previously configured permissions, and will be accessible by all users. Additionally you will need to wait ~5minutes for the cache to naturally invalidate.

1. Run the SPL below to recreate the default Analyst Queue 
   

   | makeresults
   | eval _key="__system_default_queue__"
   | eval id="__system_default_queue__"
   | eval title="Analyst Queue"
   | eval description="Analyst queue for unassigned incidents"
   | eval priority=-1
   | eval allow_override=1
   | eval wildcard_role_access=1
   | eval is_active=1
   | eval rules="[]"
   | eval rule_string=""
   | eval roles="[]"
   | eval retention_value=0
   | eval retention_unit="days"
   | eval create_time=now()
   | eval update_time=now()
   | outputlookup append=t queues_lookup