Workflow status and ownership reset after 2.41 to 3.22 ES upgrade

[jemeche]

I recently upgraded to ES 3.2.2 on a splunk 6.2.2 deployment.

For some reason all notable events have been reset to status new and the owner has been changed to unassigned.

I also can not query events using the incident_review macro any longer.

The incident_review.csv file still contains all the status and comment changes that have been made, but for some reason none of that is being populated into splunk.

Any ideas?

[LukeMurphey]

ES 3.2.1 no longer users the CSV lookup file to maintain the state of notable events; it now uses a KV-store (necessary in order to support Search Head Clustering). ES 3.2.1 automatically migrates the contents of incident_review.csv to the KV-store upon upgrade.

You should still be able to view the contents using the incident_review lookup though since the macro refers to incident_review_lookup which now points to the KV-store based lookup (unless customizations were made on your install).

I'm not sure why the statuses were reset. I would recommend opening a support case to troubleshoot the issue.