Error saving event-based detection. Missing detection_id for the detection=

[BJ17]

Unable to update and save detections after upgrading to Splunk ES version 8.1.0. It says Detection ID is missing. 

[PrewinThomas]

@BJ17 

Could you try recreating one of your existing detections in the new ES App(8.1) and check if you’re able to update and save it successfully?

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[BJ17]

We can recreate the rules without errors. But I'm looking for a way without changing the rule name.

[PrewinThomas]

@BJ17 

Currently, I don't think there is any built-in option to migrate older detections to the new versioning format(in ES 8.1) without encountering these errors..

As a workaround, can you manually add a UUID-style string as the detection_id for your existing detections in savedsearches.conf and test if this resolves the issue

Eg:
[detection_name]
detection_id = d6f2b006-0041-11ec-8885-acde48001122

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[BJ17]

Thanks @PrewinThomas ,
Splunk ES is hosted in the cloud. So, we cannot update the savedsearches.conf as you have mentioned.