Known issues for Splunk Mission Control
Known issues for Splunk Mission Control are listed on this page. If no issues appear, there are no known issues.
Splunk Mission Control
| Date resolved | Issue number | Description |
|---|---|---|
| 2024-09-25 | BLUERIDGE-12580 | The mc_artifacts, mc_events, and mc_aux_incidents indexes don't migrate to Splunk_TA_ForIndexers after upgrading to Splunk Enterprise Security 8.0. Stacks where Splunk Mission Control was previously installed might have the 'App' as either 000-self-service or _cluster_admin.
|
| 2023-09-28 | BLUERIDGE-6565 | After collapsing the risk event/summary/MITRE ATT&CK section and then expanding again, the parent-child dropdown selections reset to default, but the data in the section content persists Workaround: Don't collapse the panels, or you can refresh the page or make a new selection in the drop-down menu and the correct data should repopulate. |
| 2023-09-27 | BLUERIDGE-6559 | The page for a parent incident with more than 50 child incidents is unresponsive |
| 2023-09-06 | BLUERIDGE-6380, BLUERIDGE-6631 | You can't add summary fields as columns in the incident review table settings |
| 2023-08-30 | BLUERIDGE-6328 | The child incident row expansion momentarily displays incorrect results when you quickly expand multiple parent incidents in the incident review table Workaround: Wait a few seconds for the correct results to appear. |
| 2023-08-08 | BLUERIDGE-6075 | Some users have to reactivate Splunk Mission Control after it has already been activated by another user Workaround: Run _bump to clear the cache and update the app |
| 2023-02-13 | BLUERIDGE-4124 | You can't add the same event to more than one incident |
| 2023-02-13 | BLUERIDGE-4125 | You can add only 1000 events to an incident at a time using the add_events macro Workaround: To add more events, use the add_events macro again |