Failed to Update Investigation Status with Bad Request Error in Enterprise Security 8.x

Applicability

Description

After upgrading to Enterprise Security 8.x, users may encounter an error when attempting to change the status of an investigation to any end status (Closed, Resolved, etc.) in Mission Control or the Analyst Queue. The error appears as a red notification banner in the top right corner of the screen displaying: 

Failed to update investigation: The required custom field(s): ['_time'] for investigation type 'default' must contain a value.

This issue typically occurs after upgrading from earlier versions of Enterprise Security to version 8.x, particularly when upgrading to ES 8.3. The problem affects all investigations using the affected investigation type and prevents analysts from completing their workflow by closing or resolving investigations.

The issue is not limited to a single finding or investigation but is reproducible across all investigations that use the investigation type with the misconfigured custom field.

Investigation

To determine if you are experiencing this issue, follow these steps:
Step 1: Reproduce the Error

1. Navigate to Enterprise Security > Mission Control > Analyst Queue or open an existing investigation
2. Select a finding or investigation
3. Attempt to change the status to any end status (e.g., Closed, Resolved)
4. Observe if the error message "Failed to update investigation: Bad Request" appears

Step 2: Check Browser Console for Detailed Error

1. Open your browser's Developer Tools (Press F12 or right-click and select "Inspect")
2. Go to the Console tab
3. Attempt to close/resolve an investigation again
4. Look for error messages containing text similar to:
   

   Failed to update investigation: The required custom field(s): ['_time'] for investigation type 'default' must contain a value.

    
5. Note the field name(s) mentioned in the error message

Step 3: Inspect Investigation Type Configuration

1. Navigate to Enterprise Security > Configure > Findings and Investigations > Investigation Types
2. Click on the default investigation type (or the specific investigation type being used by your investigations)
3. Select the Custom Fields tab
4. Look for any fields with system-reserved names such as:
   • _time
   • _time. (with a period)
   • Other underscore-prefixed field names that are Splunk internal fields
5. Check if any of these fields are marked as required but do not have default values

Step 4: Check mc_incidents.log

Search the logs for detailed error messages:

index=_internal source="*/mc_incidents.log" "Failed to update investigation"

Look for entries containing the investigation ID and detailed error information about missing required fields. 

Resolution

To resolve this issue, remove the system-reserved field names from the Investigation Type custom fields:

1. Navigate to Enterprise Security > Configure > Findings and Investigations > Investigation Types

2. Click on the default investigation type (or the investigation type affected)

3. Go to the Custom Fields tab

4. Identify any improperly configured fields, particularly:

   • Fields named _time, _time., or other system-reserved field names
   • Fields that appear to have been added unintentionally during the upgrade

5. For each problematic field:

   • Click the Delete icon (trash can) next to the field
   • Confirm the deletion

6. Click Save to apply the changes

7. Test the resolution:

   • Return to the Analyst Queue or an open investigation
   • Attempt to change the status to Closed or Resolved
   • Verify that the operation completes successfully without error 
     
     
     

Related Links

• Splunk Enterprise Security: Customizing Investigation Types
• Splunk Enterprise Security: Managing Investigations
• Splunk Enterprise Security 8.x Upgrade Considerations