Findings (notables) fail to be created after upgrading to Enterprise Security 8.0

Available Languages

Updated:September 29, 2026

Document ID:SPLK048339

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Security 8.0

Description

After creating a new Event-Based Detection (EBD) rule or modifying an existing one, the findings (notables) triggered by the detection search do not appear in the Analyst Queue.

This issue occurs after upgrading Enterprise Security to version 8.0 and affects both:

Newly created EBD rules.
Pre-existing correlation searches (Event-Based Detections) from before the upgrade.

Investigation

1. Run the following Search Processing Language (SPL) query to check if the detection search executed as expected and findings were triggered:

index=_internal sourcetype=scheduler savedsearch_name=<problematic_EBD_rule_name> NOT fired=0

Example Log Output (Successful Execution)

01-30-2025 06:42:24.135 +0000 INFO SavedSplunker - savedsearch_id="nobody;SplunkEnterpriseSecuritySuite;Threat - DangerousURL Detect", search_type="scheduled", search_streaming=0, user="test_user1@company.com", app="SplunkEnterpriseSecuritySuite", savedsearch_name="Threat - DangerousURL Detect", priority=default, status=success, digest_mode=0, durable_cursor=0, scheduled_time=1738219200, window_time=-1, dispatch_time=1738219340, run_time=2.470, result_count=1, alert_actions="notable", sid="scheduler_aGlyb2FraV8xLm1hdHN1b2thQHRvcHBhbi5jby5qcA__SplunkEnterpriseSecuritySuite__RMD554f0ff8dffe019ea_at_1738219200_39565", suppressed=0, fired=1, skipped=0, action_time_ms=577, thread_id="AlertNotifierWorker-0", message="", workload_pool="standard_perf"

If fired=1, the detection successfully executed and attempted to create a notable.
If fired=0, the search did not trigger a notable, indicating an issue with the detection logic.

2. Run the following SPL query to check if the notable action encountered an error during execution:

index=cim_modactions log_level=ERROR search_name=<problematic_EBD_rule_name>

Example Log Output (Failure)

2025-01-30 10:02:23,862+0000 ERROR sendmodaction - worker="sh-i-06ba4f7530f744a5b.company.splunkcloud.com" signature="Failed to create splunk event" action_name="notable" search_name="Threat - DangerousURL Detect" sid="scheduler_aGlyb2FraV8xLm1hdHN1b2thQHRvcHBhbi5jby5qcA__SplunkEnterpriseSecuritySuite__RMD554f0ff8dffe019ea_at_1738231200_42093" rid="0" app="SplunkEnterpriseSecuritySuite" user="test_user1@company.com" digest_mode="0" action_mode="saved" action_status="failure"

If the log contains "Failed to create splunk event", it indicates an issue with notable event creation.

3. Check Entity Field Mapping in the Detection Configuration:

Navigate to Security Content > Content Management.
Locate and open the problematic detection rule.
Under Risk Modifier, verify that the Entity field matches an existing field from the detection search SPL.

Resolution

If the Entity field in the Risk Modifier does not match any existing field in the detection search, findings will not be created.

Steps to Fix:

Update the Entity field in the Risk Modifier to a valid risk_object field present in the detection search.
Save the detection rule and re-run the test.

Example Correction:

If the detection search contains src_ip but not src (as demonstrated from above screenshot), update the Entity field from src to src_ip.
Ensure the correct field is specified in the risk_object parameter under the Risk Modifier.

After applying the fix, findings should be successfully created in the Analyst Queue.