Search results for "Last 3 Days" returns no results

Products

• Carbon Black EDR

Issue/Introduction

• While performing process searches, the results for "Last 3 Days" returns no results. Expanding the results to include "All Time" provides results well within the last three days.
• Cores are not optimizing automatically.

Environment

• Carbon Black EDR Server: Supported Versions

Cause

The cbevents SOLR core is in a bad state and needs remediation.

Resolution

1. Manually optimize Solr core
2. If manual optimization of the core does not resolve the issue: 
   1. Shutdown services
   2. Confirm SOLR is shutdown

      ps -ef | grep cb-solr

       
   3. Move the core to a backup directory outside of var/cb/data/solr/cbevents/

      mv /var/cb/data/solr/cbevents/CBEVENTNAME /var/cb/corebackup/

   4. Restart the services

Additional Information

Cores moved outside of /var/cb/data/solr/* will be inaccessible within the UI until moved back to original directory.