https://community.splunk.com/t5/Splunk-Enterprise/How-to-Export-Notable-Events-from-Incident-Review-to-CSV-with/m-p/740993#M21795 <P>I'm looking to export notable events from the Incident Review dashboard in Splunk Enterprise Security to a CSV/Excel file. I need to include the following details:</P><UL><LI>Notable Name (Rule Name)</LI><LI>Notable Triggered Time</LI><LI>Time Assigned for Investigation</LI><LI>Conclusion (e.g., True Positive (TP), False Positive (FP), Benign True Positive (BTP))</LI><LI>Open/Closed Status</LI></UL><P>What would be the best SPL query or method to extract this information? Also, is there a way to automate this export on a scheduled basis?</P><P>&nbsp;</P><P>Currently using the SPL query:</P><P>`notable`<BR />| eval original_time=strftime(orig_time,"%c")<BR />| eval reviewing_time=strftime(review_time,"%c")<BR />| table search_name, comment, disposition_label, original_time, reviewing_time, owner, search_name, reviewer, status, status_description, status_label, urgency, username<BR /><BR /><BR />and I'm getting results. However, I'm not getting an ID to locate and go through an individual notable if I wanted to. How can I search for a specific notable? Is there a tracking number for a notable? I'd like to include it in my table as well.</P> Thu, 06 Mar 2025 05:48:08 GMT KKuser 2025-03-06T05:48:08Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-Export-Notable-Events-from-Incident-Review-to-CSV-with/m-p/740993#M21795 <P>I'm looking to export notable events from the Incident Review dashboard in Splunk Enterprise Security to a CSV/Excel file. I need to include the following details:</P><UL><LI>Notable Name (Rule Name)</LI><LI>Notable Triggered Time</LI><LI>Time Assigned for Investigation</LI><LI>Conclusion (e.g., True Positive (TP), False Positive (FP), Benign True Positive (BTP))</LI><LI>Open/Closed Status</LI></UL><P>What would be the best SPL query or method to extract this information? Also, is there a way to automate this export on a scheduled basis?</P><P>&nbsp;</P><P>Currently using the SPL query:</P><P>`notable`<BR />| eval original_time=strftime(orig_time,"%c")<BR />| eval reviewing_time=strftime(review_time,"%c")<BR />| table search_name, comment, disposition_label, original_time, reviewing_time, owner, search_name, reviewer, status, status_description, status_label, urgency, username<BR /><BR /><BR />and I'm getting results. However, I'm not getting an ID to locate and go through an individual notable if I wanted to. How can I search for a specific notable? Is there a tracking number for a notable? I'd like to include it in my table as well.</P> Thu, 06 Mar 2025 05:48:08 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-Export-Notable-Events-from-Incident-Review-to-CSV-with/m-p/740993#M21795 KKuser 2025-03-06T05:48:08Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-Export-Notable-Events-from-Incident-Review-to-CSV-with/m-p/741002#M21798 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/276389">@KKuser</a>&nbsp;</P><P>You probably want to include the "source_event_id" field which is a unique field for each of your notable events.</P><P>Please let me know how you get on, and please consider adding karma or accepting this post if it has helped.</P><P>&nbsp;</P> Thu, 06 Mar 2025 09:27:59 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-Export-Notable-Events-from-Incident-Review-to-CSV-with/m-p/741002#M21798 livehybrid 2025-03-06T09:27:59Z