Splunk Enterprise Security

Upgrade to ES8 - Investigations are not shown in MissionControl

kneubi
Engager

Hi

We upgraded our ES7 to ES8 onprem and are testing it.

 

We currently have the issue, that the created investigations are not shown in the MissionControl. If we oben a finding that is assigned to an investigation, we can open them from there.

If I read the documentation, the investigations should appear besides the findings inside of MissionControl . Did anyone have the same issue and have a solution for it?

Thanks for your help/hints.

Labels (3)
0 Karma
1 Solution

MaverickT
Communicator

Hi, did you create new indexes, required by ES 8.0? Eg. mc_investigations,  mc_artifacts, mc_aux_incidents, mc_events, mc_incidents_backup, cms_main...? That could be your issue.

View solution in original post

0 Karma

MaverickT
Communicator

Hi, did you create new indexes, required by ES 8.0? Eg. mc_investigations,  mc_artifacts, mc_aux_incidents, mc_events, mc_incidents_backup, cms_main...? That could be your issue.

0 Karma

masoud00013
New Member

Hi

After updating to version 8.x, do I need to create new indexes?

Please advise. Is there any documentation for this?

@inveinvestigation #index

0 Karma

kneubi
Engager

We followed the following documentation:

https://docs.splunk.com/Documentation/ES/8.0.40/Install/UpgradetoNewVersion

There is mentioned, that you need to updated the "Splunk_TA_ForIndexer" app.

 

During our upgrade, the required indexes were deployed on one single searchhead in the cluster and we had to "move them" to our index cluster.  We did it by our internal procedures. I am not aware that there is a clear documentation what you have to do exactly if you have this issue too.

0 Karma

kneubi
Engager

Thanks for the hint. Now I know where to search.

Yes, the indexes were deployed but the wrong way (the indexes were created on the searchhead and not in the cluster...)

In our environment, the app deployments does not get done by me and I have then to figure out what are the issues...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...