Known issues for Splunk Mission Control

Known issues for Splunk Mission Control are listed on this page. If no issues appear, there are no known issues.

Splunk Mission Control

Date resolved	Issue number	Description
2024-09-25	BLUERIDGE-12580	The mc_artifacts, mc_events, and mc_aux_incidents indexes don't migrate to Splunk_TA_ForIndexers after upgrading to Splunk Enterprise Security 8.0. Stacks where Splunk Mission Control was previously installed might have the 'App' as either 000-self-service or _cluster_admin.
2023-09-28	BLUERIDGE-6565	After collapsing the risk event/summary/MITRE ATT&CK section and then expanding again, the parent-child dropdown selections reset to default, but the data in the section content persists Workaround: Don't collapse the panels, or you can refresh the page or make a new selection in the drop-down menu and the correct data should repopulate.
2023-09-27	BLUERIDGE-6559	The page for a parent incident with more than 50 child incidents is unresponsive
2023-09-06	BLUERIDGE-6380, BLUERIDGE-6631	You can't add summary fields as columns in the incident review table settings
2023-08-30	BLUERIDGE-6328	The child incident row expansion momentarily displays incorrect results when you quickly expand multiple parent incidents in the incident review table Workaround: Wait a few seconds for the correct results to appear.
2023-08-08	BLUERIDGE-6075	Some users have to reactivate Splunk Mission Control after it has already been activated by another user Workaround: Run _bump to clear the cache and update the app
2023-02-13	BLUERIDGE-4124	You can't add the same event to more than one incident
2023-02-13	BLUERIDGE-4125	You can add only 1000 events to an incident at a time using the add_events macro Workaround: To add more events, use the add_events macro again