Findings Previously Selected in Analyst Queue Are Unintentionally Added to Investigations in Splunk Enterprise Security 8.x

Applicability

Description

When managing findings in the Enterprise Security 8.x Analyst Queue, users may encounter a scenario where findings from an earlier workflow are unintentionally attached to a newly created or modified investigation. 

Observed Symptoms: 
1. After adding a set of findings to an investigation and viewing that investigation, returning to the Analyst Queue shows empty or unchecked row checkboxes, but the top toolbar continues to display an active selection counter (for example, "3 selected" or "6 selected").
2. When selecting a new finding and clicking Add to Investigation, the previously selected findings ("ghost selections") are bundled into the API request payload and attached to the investigation.
3. Once attached to the investigation, the unintended findings update their Status and Owner attributes to match the parent investigation (expected ES 8.x inheritance behavior), while their Disposition remains preserved.
4. Newly generated findings may briefly display upon page refresh but disappear once column loading bars finish, reappearing permanently after 1 to 3 minutes once secondary KV Store metadata synchronization (mc_findings_lookup) completes.

Root Cause:
1. Client-Side State Persistence: The client-side array (selectedRowKeys) is not properly purged upon returning from the View Investigation view, even though the visual DOM checkboxes are reset.
2. Secondary Lookup Sync Delay: In ES versions prior to 8.8.0, an asynchronous race condition between primary finding indexing and secondary KV Store metadata joins can cause new findings to temporarily filter out until metadata propagation finishes.

Investigation

To confirm whether an environment is experiencing this Known Issue:
1. Verify selection counter desynchronization.
   1. In Enterprise Security, navigate to Analyst Queue.
   2. Create an investigation and add multiple findings using Add to Investigation.
   3. Open the investigation via View Investigation, then navigate back to the Analyst Queue.
   4. Inspect the table rows and the top toolbar.
   5. Expected result: all checkboxes are unchecked and the toolbar shows no active selection count.
   6. Observed result: table checkboxes appear unchecked, but the toolbar counter retains a non-zero count (for example, "X selected") with an active Deselect button.

2. Verify the request payload.
   1. With the ghost count still present in the toolbar, select a single new finding and click Add to Investigation.
   2. Inspect the browser network request payload, or open the resulting investigation overview.
   3. Confirm the created or updated investigation contains both the intended finding and the stale finding IDs from the previous action.

Resolution

Workaround (Immediate)

Before performing any Add to Investigation action in the Analyst Queue, perform the following validation:
1. Check the selection counter in the top toolbar of the Analyst Queue table.
2. If the counter displays active items while table checkboxes are unchecked (or shows more items selected than intended), click the Deselect button located in the toolbar.
3. Verify that the toolbar counter resets to zero and the Deselect button disappears.
4. Select only the intended finding or findings and proceed with Add to Investigation.

Permanent Fix

1. Engineering has resolved this client-side state defect under Known Issue BLUERIDGE-25550.
2. The architectural transition to Searchless Analyst Queue resolves both the ghost selection retention and the temporary metadata lookup filtering delay.
3. Both fixes are scheduled for release in Splunk Enterprise Security 8.8.0. Upgrade to ES 8.8.0 or later once available.

Related Links

* Splunk Enterprise Security Documentation: Manage Investigations in Splunk Enterprise Security
* Splunk Enterprise Security Documentation: Use the Analyst Queue