Troubleshoot detection testing in Splunk Enterprise Security

Detection must be refined during testing

Issue: Error message: Search processed too many events to complete the test.

Cause: Detection testing can fail if a detection processes over 500,000 events.

Solution: Tune your detection by modifying the search logic or filters in the detection search SPL query, adjusting risk scores, or applying exclusions. Tuning the detection helps to reduce the number of events and test the effectiveness of the detection while preventing disruption through alert storms and missed threats.

For more information on tuning detections, see Tune detections in Splunk Enterprise Security.

Rerun the detection if test was canceled by user

Issue: Detection run was canceled.

Cause: The detection test was canceled by the user.

Solution: Rerun the detection to review the test results. Use the Open in Search action in both modes: Findings and Events, to inspect the underlying SPL queries and raw events directly in the Search and Reporting app.

Test detections across standard lookback time presets

Issue: Detection testing fails.

Cause: Testing can fail due to default timeout periods.

Solution: Test detections across standard lookback time presets to efficiently estimate the volume of findings without exiting from the detection editor or blocking timeout periods. The Findings mode does not have a timeout period set for testing detections. However, you can use the time range picker in the Events mode with 1-day, 7-days and 30-days presets.