Search Notables for Open and Closure Times

splunkeradmin22 — Fri, 09 Jul 2021 20:25:05 GMT

Hi Everyone,

I am trying to write a query that will allow me to use my notable_events table, display the time the notable opened and the time it was closed.

Looking through the forums I found:

|eval _time=strftime(_time,"%Y/%m/%d %T")
|eval review_time=strftime(review_time,"%Y/%m/%d %T")
|eval assign_time = case(isnotnull(owner), _time) | eval close_time = case(status=5, review_time)
|stats min(_time) as notable_time min(assign_time) as assign_time min(close_time) as close_time by AlertTitle,owner

But that isn't quite working as it returns 0 results.

Re: Search Notables for Open and Closure Times

efika — Fri, 16 Jul 2021 18:51:19 GMT

Hi @splunkeradmin22 ,

Have a look at the below macro:

|`incident_review`

topic Re: Search Notables for Open and Closure Times in Splunk Enterprise Security

Search Notables for Open and Closure Times

Re: Search Notables for Open and Closure Times