Why is "Edit notable events section" on incident review page not visible?

[rajanshrivastav]

I'm not getting edit option in incident review page under SplunkEnterpriseSecuritySuite.

I'm using Splunk App for Enterprise Security app version 4.5.0. I'm facing this issue for every users(admin also).

Kindly help me in this to resolve this issue.

Thanks,

[koshyk]

This is normally because of Permissions. Try putting your userid role inherits "essadmin" and "admin" and see how it goes

[rajanshrivastav]

I'm using this with super-admin role also, I've essadmin & admin privileges but none of them working.
Also I upgraded enterprise security app to 4.7.6 but this didn't help.

Thanks,

[smoir_splunk]

What version of Splunk Enterprise are you using? Are there any errors in the browser console?

[rajanshrivastav]

I'm using Splunk 6.5.3 & Splunk App for Enterprise Security app version 4.5.0. There is no error showing in the browser. Only thing, I'm not seeing any option to edit under the incident review page.

Earlier it was showing and edit notable events section in incident review page is not visible and we couldn't change the status of each of the notable alerts and provide comments.

Please let me know if you need any more info.

Thanks,