Major incident

Splunk Cloud Platform: Service Advisory: KVservice issues impacting Enterprise Security search performance

Affected: Search

Current status of Splunk Cloud Platform: Operational — live Splunk Cloud Platform status

Timeline

1. Apr 9, 2026, 00:10 UTC
   investigating
   Our engineering team has identified an issue with the KVservice that is currently impacting search performance for ad-hoc, saved, and scheduled searches. Additional symptoms may include, but not limited to: - Inability to save searches within the Enterprise Security (ES) application. - Errors when attempting to update application settings, such as credentials. This is an active investigation. We are working to resolve this as quickly as possible and will provide status updates as more information becomes available. We apologize for any inconvenience this may cause.
2. Apr 9, 2026, 01:04 UTC
   identified
   Our engineering teams have narrowed the scope of the issue: Any search utilizing the KV Services were failing. This impact extended to the Mission Control and Analyst Queue dashboards. Additionally, we have identified the root cause and are actively mitigating the impact. Once mitigation is complete, we will continue to monitor the environment to ensure service stability for all users. We will continue to provide status updates as more information becomes available. We apologize for the inconvenience and appreciate your patience.
3. Apr 9, 2026, 01:25 UTC
   resolved
   Our engineering team has successfully implemented the fix for the KVservice issue. We have monitored the environment and can confirm that there are no recurring errors. All searches and dashboards within the Enterprise Security (ES) application are now fully operational. If you continue to experience any issues related to this incident, please contact us by submitting a support case. We apologize for the inconvenience this may have caused and appreciate your patience as we worked to restore service.

Updates as published by Splunk Cloud Platform (original).