https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-notable-event-s-drilldown-URL/m-p/567489#M10301 <P>Found that using the orig_sid in the notable's event fields can provide the indirect link to the drilldown.&nbsp;</P><P>Ex. localhost:8000/en-US/app/SplunkEnterpriseSecuritySuite/search?sid=&lt;orig_sid&gt;</P> Fri, 17 Sep 2021 20:28:20 GMT zyun 2021-09-17T20:28:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-notable-event-s-drilldown-URL/m-p/565272#M10234 <P>We're currently using Splunk ES, and would like to grab the link to a notable event's drilldown link on the ES Incident Review page without having to manually copy it.&nbsp;<BR /><BR />The closest solution that I've come across is automatically building the URL by using a `notable` search and piecing together the earliest/latest times and drilldown search, but I feel like there might be a more elegant solution out there.</P> Mon, 30 Aug 2021 23:39:26 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-notable-event-s-drilldown-URL/m-p/565272#M10234 zyun 2021-08-30T23:39:26Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-notable-event-s-drilldown-URL/m-p/567489#M10301 <P>Found that using the orig_sid in the notable's event fields can provide the indirect link to the drilldown.&nbsp;</P><P>Ex. localhost:8000/en-US/app/SplunkEnterpriseSecuritySuite/search?sid=&lt;orig_sid&gt;</P> Fri, 17 Sep 2021 20:28:20 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-notable-event-s-drilldown-URL/m-p/567489#M10301 zyun 2021-09-17T20:28:20Z