Mission Control Page slowness after Enterprise Security is upgraded to 8.2

Available Languages

Updated:October 1, 2026

Document ID:SPLK053496

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Security

Description

After Enterprise Security is upgraded to version 8.x, Mission Control/Incident Review Page shows slowness and takes a long time to load findings and investigations.

Investigation

KVStore collection supports a maximum of 10 accelerated fields by default but 'mc_incidents' collection has 16 accelerated fields, so 6 of the 16 will never get created in database.

As a result the 'notable_id' index is not created resulting in the slowness of Mission Control page load time.

Resolution

There are two options:

1. Update below setting in limits.conf. This step can relieve the issue temporarily.

[kvstore]
max_accelerations_per_collection = 16

2. Update ES to version 8.3.0
This is the recommended way to resolve the issue as this is the permanent fix.

Revision History

Revision	Publish Date	Comments
1.0	01-Oct-2026	Initial Release

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)