Splunk Enterprise Security

Enterprise Security 6.6.0 Incident review shows suppressed notables

marios_kstone
Path Finder

Hello,

we just updated ES from 6.4 to 6.6. The new incident review dashboard completely ignores suppressed events, showing them in the list. Is this a known issue or something caused by the upgrade?

Anyone has a solution for this?

(Splunk Enterprise version 8.1.3)

Thanks

 

Labels (1)
0 Karma
1 Solution

marios_kstone
Path Finder

After some investigation and analyzing the "Incident Review - Main" new query, I found out that the suppression removal is moved way up in the new query compared to previous one. Modifying the query placing the suppression near the end of the query fixed it...

View solution in original post

danilomb
Engager

Hi @marios_kstone,

we just had the same issue but were able to fix it with solution mentioned in here

https://community.splunk.com/t5/Deployment-Architecture/Why-does-an-eventtype-calling-a-macro-only-f...

Adding the macros.conf file to the replication bundle via distsearch.conf let the eventtypes for notable suppression appear again.

/opt/splunk/etc/system/local/distsearch.conf
[replicationSettings:refineConf]
replicate.macros = true
 
Regards,
Daniel

 

gabriel_vasseur
Contributor

This should be the proper answer. We had the same issue and it fixed it.

According to btool, before fixing it, the "replicate.macros" setting didn't even exist on our search heads. But after setting it to true, suppressions started working in IR.

Another quality software update from splunk 🙄

marios_kstone
Path Finder

After some investigation and analyzing the "Incident Review - Main" new query, I found out that the suppression removal is moved way up in the new query compared to previous one. Modifying the query placing the suppression near the end of the query fixed it...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...