Enterprise Security 6.6.0 Incident review shows suppressed notables

[marios_kstone]

Hello,

we just updated ES from 6.4 to 6.6. The new incident review dashboard completely ignores suppressed events, showing them in the list. Is this a known issue or something caused by the upgrade?

Anyone has a solution for this?

(Splunk Enterprise version 8.1.3)

Thanks

[danilomb]

Hi @marios_kstone,

we just had the same issue but were able to fix it with solution mentioned in here

https://community.splunk.com/t5/Deployment-Architecture/Why-does-an-eventtype-calling-a-macro-only-f...

Adding the macros.conf file to the replication bundle via distsearch.conf let the eventtypes for notable suppression appear again.

/opt/splunk/etc/system/local/distsearch.conf

[replicationSettings:refineConf]

replicate.macros = true

Regards,

Daniel

[gabriel_vasseur]

This should be the proper answer. We had the same issue and it fixed it.

According to btool, before fixing it, the "replicate.macros" setting didn't even exist on our search heads. But after setting it to true, suppressions started working in IR.

Another quality software update from splunk 🙄

[marios_kstone · Accepted solution]

After some investigation and analyzing the "Incident Review - Main" new query, I found out that the suppression removal is moved way up in the new query compared to previous one. Modifying the query placing the suppression near the end of the query fixed it...