Known issues

The following tables include issues and workarounds for releases of Splunk Enterprise Security. Issues are listed in all relevant sections. Some issues appear more than once.

Splunk Enterprise Security 8.5.x known issues

Known issues in Splunk Enterprise Security 8.5.1

Following are some of the known issues in Splunk Enterprise Security version 8.5.1:

Note: Detection versioning is turned off temporarily in this version of the release.

Known issues in Splunk Enterprise Security 8.5.0

Following are some of the known issues in Splunk Enterprise Security version 8.5.0:

Note: Detection versioning is turned off temporarily in this version of the release.

Date filed Issue number Description
2026-03-09 SECHELP-341

Environments with detection versioning turned on might result in the DA-ESS-ContentUpdate (ESCU) and other apps stuck "in-progress" for updating version information. This can prevent you from editing the detections in the UI.

Splunk Cloud workaround: Detection versioning is turned off for impacted customers. This action reverts detection management to a non-versioned status until a permanent fix is provided.

On-premises workaround:
  1. Disable detection versioning on each of the search heads by disabling the CMS modular input using the API: curl -k -X POST https://{STACK_URL}/servicesNS/nobody/SA-ContentVersioning/data/inputs/cms_parser/main/disable
  2. Disable detection versioning: curl -k https://{STACK_URL}:8089/servicesNS/nobody/SA-ContentVersioning/properties/feature_flags/general \ -X POST \ -d versioning_init="0" \ -d versioning_activated="0"
2026-04-13 SECHELP-448

After upgrading to ES version 8.4 or ES version 8.5, ad-hoc searches that are launched from the ES app are run under the Mission Control app context, instead of the ES app context. Knowledge objects such as lookups are based on the search app context.

This can cause the following issues for any customer-configured ES knowledge object that is app-scoped, such as lookups:
  1. Failed inputlookup or other lookup-based searches
  2. Lookup table errors in the ES search bar
  3. Missing enrichment in search results
  4. Field extractions, macros, event types, field aliases, or saved search-related behavior might not work as expected
  5. Silent failures where the search runs but returns incomplete or inconsistent results
2026-03-16 SECHELP-363 Configuration settings in the local/savedsearches.conf file lost or changed after an ES 8.x upgrade. Workaround: Disable the modular input by running the following curl command:
CODE 
curl -k -v -X POST -u<admin username>:<password> https://localhost:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/data/inputs/configuration_check/confcheck_es_migrate_faulty_riskmodifiers/disable
For on premises, run the curl command on the ES Search Head. If using a search head cluster, run the curl command on the primary node.