https://community.splunk.com/t5/Monitoring-Splunk/Edit-All-Matching-Notable-Events-Can-we-undo-this/m-p/574856#M8681 <P>Hello folks!</P><P>That is my first post here and I hope you guys help me with my issue.</P><P>I have inadvertently selected 4000+ notes and closed them all with the same note.&nbsp;</P><P>Is there any script or anything on the ES Splunk UI I miss that can undo my mistake?</P><P>Your help is much appreciated!</P><P>Thank you all.&nbsp;</P> Sun, 14 Nov 2021 21:56:26 GMT DanAlexander 2021-11-14T21:56:26Z https://community.splunk.com/t5/Monitoring-Splunk/Edit-All-Matching-Notable-Events-Can-we-undo-this/m-p/574856#M8681 <P>Hello folks!</P><P>That is my first post here and I hope you guys help me with my issue.</P><P>I have inadvertently selected 4000+ notes and closed them all with the same note.&nbsp;</P><P>Is there any script or anything on the ES Splunk UI I miss that can undo my mistake?</P><P>Your help is much appreciated!</P><P>Thank you all.&nbsp;</P> Sun, 14 Nov 2021 21:56:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/Edit-All-Matching-Notable-Events-Can-we-undo-this/m-p/574856#M8681 DanAlexander 2021-11-14T21:56:26Z https://community.splunk.com/t5/Monitoring-Splunk/Edit-All-Matching-Notable-Events-Can-we-undo-this/m-p/620011#M9222 <P>This might be a bit late but I actually did the same and would like to offer solution for others in same situation.&nbsp;</P><P>You just need to delete the entries from the incident_review lookup which should be a kv store.&nbsp;</P><P>I would test first to ensure that you don't accidentally delete your other legitimate updates because they can easily be wiped out.</P><P>I used the lookup editor to do this.&nbsp; I would carefully test out first before trying any bulk deletes though.</P> Tue, 08 Nov 2022 00:43:18 GMT https://community.splunk.com/t5/Monitoring-Splunk/Edit-All-Matching-Notable-Events-Can-we-undo-this/m-p/620011#M9222 tah7004 2022-11-08T00:43:18Z