Splunk for Enterprise Security: Why do we get the UI message "The incident review lookup file is currently being edited"?

[mzax]

When we try to change the status and update a notable event from the Incident Review dashboard we are prompted with a banner stating
"The incident review lookup file is currently being edited, please wait a bit and re-submit your changes"

[mzax · Accepted solution]

You are probably using NFS for the storage.
NFS needs to be configured with supports for file locks. Without file-locking support, this error will occur.
As well as ensure that the nfslockd process is up and running.