Known issues

Error Definition is invalid error is displayed when you try to access a modified dashboard after upgrading to ES version 8.0.40 or higher.

Workaround: If a dashboard displays Definition is invalid error, close the error message, edit the dashboard in the UI, make a small change, and save. This updates the definition to the new schema. You can revert the change and save again if required.

Your role must not possess the managed capabilities that are assigned using the Roles and capabilities page in Splunk Enterprise Security. For example, if you want to provide managed access for editing lookups to the role: Edit lookups, this role cannot consist of edit_managed_configurations capability, which can trigger and update the configuration of the lookup.

For example if a user intend to provide "Edit lookups" managed access, the role should not consist of edit_managed_configurations, edit_lookups capabilities for the workflow action to trigger and update the configuration. For more information, see Manage capabilities for a role.

Watermark on all world maps on Entity Analysis Page