https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13615#M65 <P>Yes, we need this!!!</P> Fri, 24 Sep 2010 07:02:28 GMT araitz 2010-09-24T07:02:28Z https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13612#M62 <P>Is there a way to add an additional field to every event for acknowledgment?</P> <P>I'm analyzing failed login attempts. As some of them happened for a known reason I'd like to mark them somehow in the final report.</P> Mon, 17 May 2010 09:33:23 GMT https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13612#M62 kkuminsky 2010-05-17T09:33:23Z https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13613#M63 <P>This sure would be a nice feature.</P> Wed, 19 May 2010 19:41:53 GMT https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13613#M63 netwrkr 2010-05-19T19:41:53Z https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13614#M64 <P>I am doing something similar to what you're trying to do -- basically I am tagging events in splunk with change ticket numbers using lookups. You should be able to tune this to your requirements:</P> <P><A href="http://answers.splunk.com/questions/3982/correlate-and-tag-splunk-events-with-change-control-tickets" rel="nofollow">http://answers.splunk.com/questions/3982/correlate-and-tag-splunk-events-with-change-control-tickets</A></P> Fri, 02 Jul 2010 02:20:14 GMT https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13614#M64 ftk 2010-07-02T02:20:14Z https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13615#M65 <P>Yes, we need this!!!</P> Fri, 24 Sep 2010 07:02:28 GMT https://community.splunk.com/t5/Knowledge-Management/Additional-field-event-acknowledgment/m-p/13615#M65 araitz 2010-09-24T07:02:28Z