Cannot add column to Analyst Queue in Enterprise Security 8.1

[lukasmecir]

Hello,

I have problem with Analyst queue:

I am not able to add column to Analyst Queue in GUI. When I do this (using the cogwheel icon on Analyst queue dashboard), column is added, but when I log off and log on again, previously added column disseapers and Analyst queue is in default setting again.

I expected that new config of Analyst Queue will be saved in $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/local/log_review.conf, but I found that this file remains untouched when I add new column.

Is there any way how to add new column to the AQ permanently? Now I am aware only about one way - manually edit $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/local/log_review.conf file (this works), but this is not usable for analysts who would like to customize AQ GUI and have not privilege to edit config files.

Environment is Search Head cluster (3 nodes) with Splunk Enterprise 9.3.0 and Enterprise Security 8.1.0.

Any hint would be highly appreciated.

Best regards

Lukas Mecir

[PrewinThomas]

@lukasmecir 

I think Analyst Queue GUI changes to columns are session-based only, not writing to the disk. I recommend submitting a feature request to Splunk Support.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid]

Hi @lukasmecir 

I dont see this listed as a known issue at https://help.splunk.com/en/splunk-enterprise-security-8/release-notes-and-resources/8.1/splunk-enter... so I would recommend raising this as a support case and hopefully they will assign it a bug ticket reference (or match to an existing if already reported by someone), this way you'll be able to track if/when a fix for this is applied.

It does seem like the sort of thing which should persist without hand-editing of conf files in the system!

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing