Splunk Enterprise Security

Why is ESS "My Investigations" is not Loading.

Explorer

When I go to ESS "My Investigations" Section it hangs on Loading. We are at Splunk Enterprise v7.2.3 and Splunk Enterprise Security v5.2.2. I looked at the Deployer where ESS was installed and noticed the " My Investigations" was named "Investigations. On the SHC the name is "My Investigations"

0 Karma

Explorer

The fix was to go to Configure -> General -> Navigation. On the Edit Navigation Page, remove the My Investigations View and Add a New View called Investigations. Save and restart Splunk.

Splunk Employee
Splunk Employee

Yes, since the app preserves local navigation settings, any navigation changes due to release changes need to be updated manually. Win some / lose some 🙂

0 Karma