Unable to Enable Multiple Content Management Rules in Splunk Enterprise Security

[amimulahasun]

Hi everyone,

I'm currently working with Splunk Enterprise Security and running into an issue when trying to enable multiple content management rules at once.

In the Content Management section (Security Content → Content Management), I select multiple detections/rules and attempt to enable them using Edit Selection → Turn On. However, the rules are not getting activated as expected.

Steps I followed:

1. Navigated to Enterprise Security → Content Management.

2. Selected multiple content items using the checkboxes.

3. Clicked Edit Selection.

4. Chose Turn On to activate the selected rules.

Issue:
The selected rules do not get enabled, or the action does not apply to all selected rules.

Environment Details:

• Splunk Enterprise Security version: (add your version here)

• Splunk Enterprise version: (add your version here)

• Content type: Mostly Event-based detections / analytic stories

What I want to achieve:
I want to bulk enable multiple content management rules instead of enabling them one by one.

Questions:

• Is there any limitation on bulk enabling rules in Content Management?

• Are there any required permissions or configurations needed for this action?

• Is there an alternative method (e.g., via search, API, or configuration) to enable multiple detections at once?

I've attached a screenshot for reference.

Any guidance or suggestions would be greatly appreciated.

Thanks!

[livehybrid]

Hi @amimulahasun 

The top 3 are Analytic Stories and not searches so I dont think they have a 'turn on' option - If you untick these does it allow you to turn the others on?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[amimulahasun]

@livehybrid Also tried that but it didnot worked