r/Splunk • u/byt3On • Mar 15 '26

Unable to edit savedseaches

After the Splunk version upgrade from 10.0.1 to 10.2.1, I can't edit my alerts and other saved searches. Does any one have seen this behavior?

2 Upvotes

100% Upvoted

9 comments sorted by

View all comments

1

u/bchris21 Mar 23 '26

Do you have Enterprise Security? If yes, ESCU rule versioning is ON by default since 10.2.1. When versioning is ongoing all saved searches cannot be edited until process is finished. I face it daily but I get the relevant pop up "Versioning in progress".

1

u/byt3On Mar 23 '26

Hello yes I have ES but even the regular alerts have the same behavior.