Splunk® Enterprise Security

Troubleshoot Splunk Enterprise Security

The documentation for Splunk Enterprise Security versions 8.0 and higher have been rearchitected from previous versions, causing some links to have redirect errors. To resolve redirect errors, you must use the version selector on the ES documentation homepage to navigate between the versions.

Troubleshoot detections with multiple drill-down searches

Issue

An error might occur in the Analyst Queue page if two or more drill-down searches are saved using the same name such as "View all findings in Search".

Cause

In Splunk Enterprise Security, the default drill down search that is associated with a detection is identified by the same name as the detection on the finding-based detection editor. This can cause errors if two or more drill down searches are created and saved using the same name.

Solution

Do not create multiple drill-down searches with the same default name in the same detection. Instead, use token or prop values to identify drill down searches in a detection. You can also delete a drill-down search with the same name such as "View all findings in Search" if it is not the first drill-down search for the detection.

Last modified on 05 May, 2025
Troubleshoot detections with special characters   Troubleshoot risk modifiers in Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 8.1.0

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters