Splunk Saved Search and Dashboard Issue

Incident Report for UNC Chapel Hill - ITS

Resolved

This inicdent has been resolved.

Issue has been resolved

Posted Jun 24, 2025 - 16:33 EDT

Identified

Around 11:10 AM this morning, a bundle push was triggered for a role change. This has left the Splunk search heads in a state where they are not able to sync with each other.

The impact of this is limited to search head replication functionality, such as modifying alerts/saved searches being replicated to other search heads. Data ingest and search itself is unaffected.

We have opened a P1 ticket with Splunk, and are working on testing resolutions in our nonproduction environment.
Posted Jun 24, 2025 - 14:13 EDT
This incident affected: Splunk.