Splunk Enterprise Security

Probleemoplossing

Support FAQ

• Manage ES lookup retention period. 07-Oct-2026new
• Workload rules not functioning due to invalid runtime predicate in workload management configuration 03-Oct-2026new
• Users with a custom role receive a bad request error when changing an investigation status in Splunk Enterprise Security 8.x 03-Oct-2026new
• Incorrect risk_score for finding groups in Enterprise Security (ES) 8.6.1 03-Oct-2026new
• Enterprise Security - missioncontrol updating thousands of times per hour causing replication issues 03-Oct-2026new
• Unable to transition custom statuses in Findings or Investigations after upgrading to ES 8.6.1 or 8.7 - "Failed to update finding: Failed to update status from custom_status_1 to custom_status_2 because the transition is not allowed" 03-Oct-2026new
• UEBA behavior-based detections does not appear on Content Management UI 03-Oct-2026new
• Notable Comments are no longer found in index=_audit or in |'incident review' 02-Oct-2026new
• UEBA behavior-based detections not appeared on Content Management UI 01-Oct-2026new
• SOAR and Enterprise Security cannot communicate or pair after a new license is installed 01-Oct-2026new
• Health Check warning for intel_exporter.py exiting abnormally with exit status 1 01-Oct-2026new
• Findings Previously Selected in Analyst Queue Are Unintentionally Added to Investigations in Splunk Enterprise Security 8.x 01-Oct-2026new
• Enterprise Security Correlation Searches Return Zero Results on Schedule Due to Timestamp Extraction Timezone Lag 01-Oct-2026new
• Enterprise Security Asset field limit warning banner and data truncation during asset merge 01-Oct-2026new
• Analyst Queue REST handler fails with persistent "bad character (49) in reply size" errors 01-Oct-2026new