Hi there,
In Mission Control in our properly working Splunk environment, we see the following:
This is exactly how we want it: the finding based correlation search "Threat - Findings Risk Threshold Exceeded for Entity Over 24 Hour Period - Rule" fired because of multiple findings that occured for one specific entity. If you expand it, then it shows all the findings.
(Please ignore the weird names of the findings)
Then in our other environment, it looks differently.
When you click expand, it has to think for a while:
And then it just shows the number of intermediate findings, but the not the actual findings themselves.
You also can't click on this grey label.
I suspect it has something to do with the fact that our working environment is a somewhat fresh install, whereas the environment in which it doesn't work properly is an upgrade from an old ES version to the newest version. There might be some index problems or something, I don't know.
Does anyone know?
