I have recently installed Splunk Enterprise Security v8.4 on a fresh Splunk instance after successfully using v8.2 on a previous instance. However I have an issue when using investigations. To even create an investigation I had to manually add the "default" investigation type. The issue I am having now is that the investigation pops up for a short time when refreshing the queue and then disappear after that. Is this a known issue, will this require an ESS reinstall?   ... View more

I have a problem that had occurred a little while ago, the metadata for source has disappeared from all windows events, however it remains on other events. This has not really been a problem up until now when setting up Enterprise Security, where some of the macros e.g. `powershell`, which selects events based on the source. The strange part about this is problem is that field extractions based on the source still seem to work, e.g. the Sysmon app (adapted to work with plain text rather than xml) is extracting `process_name` properly. Does anyone know why this may be? Any help is greatly appreciated.   ... View more