Splunk® Enterprise Security

Release Notes

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Known issues for Splunk Enterprise Security

This version of Splunk Enterprise Security has the following reported known issues and workarounds. Some issues may appear in more than one section.


Date filed Issue number Description
2019-02-19 SOLNESS-18079 Port And Protocol Tracker Lookup Gen isn't tracking allowed ports
2018-12-16 SOLNESS-17285 Custom Role inheritance is not working in ES app after upgrade

Workaround:
Contact support for patch.
2018-09-18 SOLNESS-16563 globedistance macro units syntax does not match usage in summary gen search

Workaround:
The following syntax for Access - Geographically Improbable Access - Summary Gen:

eval key=mvsort(mvappend(src."->".dest, NULL, dest."->".src)) | dedup key, user | `globedistance(src_lat,src_long,dest_lat,dest_long,"m")`
 

Should be:
eval key=mvsort(mvappend(src."->".dest, NULL, dest."->".src)),units="m" | dedup key, user | `globedistance(src_lat,src_long,dest_lat,dest_long,units)`
 
2018-04-30 SOLNESS-15339 Not all of the URIObj:URIObjectType objects from FS-ISAC stix_parser ingested into Splunk ES
2018-04-20 SOLNESS-15255 action.summary_index = True changes back to false after correlation search is saved via the UI
2018-03-28 SOLNESS-15042 Unable to parse and import some STIX files obtained from www.us-cert.gov. NamespaceNotFoundError: Namespace not found: http://us-cert.gov/ciscp
2018-03-28 SOLNESS-15033 contentinfo datamodel regex parser for tstats/from is incorrect
2018-03-22 SOLNESS-14982 Extreme Search app unintentionally downgraded
2018-03-15 SOLNESS-14897, SOLNESS-15165 IR actions fails to render when invalid special parameter is used in workflow action
2018-03-09 SOLNESS-14831, CIM-778, SOLNESS-16902 Excessive log rotation error on Windows for correlationmigration_rest_handler.log file, required manual roll of file

Workaround:
Manually roll the correlationmigration log file.
2018-02-20 SOLNESS-14643, SOLNESS-15654 Post ES 4.7.4 upgrade process does not re-enable all the apps
2018-02-13 SOLNESS-14603 Splunk_SA_CIM version 4.10.0 is lower than required 4.9.1

Workaround:
Suppress the message via inputs.conf
## $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf
[configuration_check://confcheck_es_app_version]
suppress = Splunk_SA_CIM
2018-02-13 SOLNESS-14596 TA-cef: (KV_MODE=auto) does not properly extract CEF events
2018-02-02 SOLNESS-14399 "Audit -> Content Profile" dashboard searches fail
2018-01-22 SOLNESS-14285 Assets identity correlation setup: automatic lookup for asset str matching misses "dvc_ip" and "src_ip" as output fields.
2018-01-18 SOLNESS-14237 500 server error when users without admin_all_object capability saves Identity Lookup Setting.
2018-01-12 SOLNESS-14140, SOLNESS-14154 Custom swimlane searches are not showing output on the investigator dashboards.
2018-01-09 SOLNESS-14034 Blank identitiy_lookup_expanded table stops ES identity data being updated
2017-12-07 SOLNESS-13840 Investigation print displays Dec 31, 1969 4:00 PM as a secondary timestamp for all entries.
2017-11-09 SOLNESS-12599 Glass table lines always appear at the front, even when sent to back.
2017-10-30 SOLNESS-12543 When Printing Investigation, events include start and end times, but end times are epoch=0
2017-10-16 SOLNESS-12495 Investigations does not appear in ES navigation menu toolbar after upgrade to 4.7.x.

Workaround:
Because the Investigations page was renamed in 4.6.x and the navigation editor now respects local overrides, the My Investigations page disappears from the navigation and the Investigations page does not replace it. To add the Investigations page to the navigation, select Config > General > Navigation and add the Investigations view to the navigation in Splunk Enterprise Security.
2017-06-22 SOLNESS-12151 /services/shcluster calls fail under dev license.
2017-05-07 SOLNESS-12049 Double quote in correlation search name causes "unknown" notable description in Incident Review dashboard

Workaround:
Remove the double quote from the correlation search name.
2017-04-14 SOLNESS-11988 Nav Editor: Cancel button doesn't work
2017-04-05 SOLNESS-11913 Glasstable searches containing | rest may display inaccurate results on Core Splunk 6.6+

Workaround:
Log in as a user who is a member of or inherits the "admin" role to ensure that the data presented in the Glass Table view is complete.
2017-03-30 SOLNESS-11872 Session Center Page : UBA tab : Export to PDF does not include UBA results
2017-01-13 SOLNESS-11296 SA-ExtremeSearch display_context view does not work in Splunk platform 6.5+

Workaround:
Download the Extreme Search Visualizations app from Splunkbase to use updated dashboards that are compatible with newer versions of the Splunk platform.
2016-12-22 SOLNESS-11188 Images attached to Timeline are not displayed on 6.5.x if they are larger than 512KB.
2016-12-12 SOLNESS-11120 When printing a dashboard, key indicators show up large and with the drilldown link in parentheses.
Last modified on 04 April, 2019
PREVIOUS
Fixed issues for Splunk Enterprise Security
  NEXT
How to find answers and get help with Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 4.7.4


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters