Enterprise Security in Splunk 7.1

[jowenssi]

There appears to be issues with Splunk Enterprise on Splunk 7.1

Is there a reason that the Incident Review "Urgency" selection panel is not showing? [See Image Below]

I have tested this with clean installs of ES 4.7.4 and 5.0.

[jowenssi · Accepted solution]

Splunk Enterprise Security 5.1 is compatible with Splunk 7.1.

Per the docs: Splunk Web for Splunk 7.1.0 and Splunk Enterprise Security 5.1.0 provides an updated look and feel. As a result, these two releases of the Splunk platform and Splunk Enterprise Security are only supported with each other.

http://docs.splunk.com/Documentation/ES/5.1.0/RN/Enhancements

[jorgepinto1]

Wouldn't it be nice to put some sort of warning on the site or at the top of the release notes? Just wondering.

[aagudelos]

Do you have a possible date for this update?

[smoir_splunk]

Nope, as I stated in the comments to my answer, the next release will be compatible, but we can't publicly comment about timelines. You can trust that we know this is a pain point for customers to have a lag time like this, and are working to address that.

[jamesbrock]

Interesting.

Shouldn't a .1 release be compatible with or have an accompanied upgrade for a flagship modules like ES 5.0.0 released not long ago?

just a thought ...

[delink]

Reading the release notes is an important part of any upgrade. 🙂

[itradeclayton]

imagine that!!! 🙂

[smoir_splunk]

There is no version of Splunk Enterprise Security that is compatible with Splunk Enterprise or Splunk Cloud 7.1 at this time.

[gjanders]

Please update your answer to advise 7.1 is released when you have time.
Blog post here and release notes here

[tommoore]

Is there an ETA on when it's going to be compatible? I'm in the same boat on my production instance.

[itradeclayton]

hopefully it doesn't take as long as it it did for the F5 add-on... 😕

[jowenssi]

Splunk ES 5.1 was released and supports Splunk 7.1

"Splunk Web enhancements and version compatibility Splunk Web for Splunk 7.1.0 and Splunk Enterprise Security 5.1.0 provides an updated look and feel. As a result, these two releases of the Splunk platform and Splunk Enterprise Security are only supported with each other." - http://docs.splunk.com/Documentation/ES/5.1.0/RN/Enhancements

[itradeclayton]

need an update for ES 4.x... it will be a while before we upgrade to ES 5.

[smoir_splunk]

4.7.6 was the last update to ES 4.x

[jowenssi]

From the information I've been able to gather, we're waiting for the next ES release to include the updated UI components necessary for compatibility with 7.1.

[smoir_splunk]

The next release will be compatible, but we can't publicly comment about timelines. You can trust that we know this is a pain point for customers to have a lag time like this, and are working to address that.

[tommoore]

Thank you smoir for responding. Everything seems somewhat ok except for the incident_review_page.xml .. Browser console shows "Uncaught TypeError: i._btnClass is not a constructor"

If only I knew javascript 🙂

[smoir_splunk]

There is almost certainly other stuff going on behind the scenes, but incident review is always the most obvious one that is affected 🙂