Upgrade to ES8 - Investigations are not shown in MissionControl

[kneubi]

Hi

We upgraded our ES7 to ES8 onprem and are testing it.

We currently have the issue, that the created investigations are not shown in the MissionControl. If we oben a finding that is assigned to an investigation, we can open them from there.

If I read the documentation, the investigations should appear besides the findings inside of MissionControl . Did anyone have the same issue and have a solution for it?

Thanks for your help/hints.

[MaverickT · Accepted solution]

Hi, did you create new indexes, required by ES 8.0? Eg. mc_investigations,  mc_artifacts, mc_aux_incidents, mc_events, mc_incidents_backup, cms_main...? That could be your issue.

[masoud00013]

Hi

After updating to version 8.x, do I need to create new indexes?

Please advise. Is there any documentation for this?

@inveinvestigation #index

[kneubi]

We followed the following documentation:

https://docs.splunk.com/Documentation/ES/8.0.40/Install/UpgradetoNewVersion

There is mentioned, that you need to updated the "Splunk_TA_ForIndexer" app.

During our upgrade, the required indexes were deployed on one single searchhead in the cluster and we had to "move them" to our index cluster.  We did it by our internal procedures. I am not aware that there is a clear documentation what you have to do exactly if you have this issue too.

[kneubi]

Thanks for the hint. Now I know where to search.

Yes, the indexes were deployed but the wrong way (the indexes were created on the searchhead and not in the cluster...)

In our environment, the app deployments does not get done by me and I have then to figure out what are the issues...