Analyst Queue finding updates revert when edited from the right-side panel

Applicability

Description

Changes to a finding made through the Analyst Queue right-side edit panel can revert after navigating to another tab or view. Affected fields can include Owner, Status, Urgency, and Disposition.

Investigation

Reproducing the issue:

1. In the Analyst Queue, update one of the affected fields using the right-side edit panel.
2. Navigate to another tab or view and return to the finding.
3. Confirm whether the updated value has reverted to its prior value.
4. Review the configured Side panel update interval value in Configure > Analyst queue settings is not 0.

Resolution

The permanent fix will be in Splunk Enterprise Security release 8.8 or later.

The following workaround can be applied in current version:

1. Navigate to Configure > Analyst queue settings in Splunk Enterprise Security.
2. Set Side panel update interval to 0.
3. Save the setting. Setting it to 0 is disabling the auto update.
4. Refresh the Analyst Queue page. Update a finding from the Analyst Queue right-side edit panel, navigate away, and confirm that the updated value persists.

Related Links

• Splunk Docs - Configure the settings for the analyst queue in Splunk Enterprise Security