https://community.splunk.com/t5/Splunk-Enterprise-Security/es-notable-events-Query/m-p/709495#M12261 <P>Hi folks,</P> <P>Looking to use&nbsp;es_notable_events as a way of building out a panel that will get info on ES events for the past 7 days, specifically how many alerts were closed by the team and what the alert name is. The search I am using is as follows:</P> <LI-CODE lang="markup">| `es_notable_events` | search timeDiff_type=current | stats sparkline(sum(count),30m) as sparkline,sum(count) as count by rule_name | sort 100 - count | table rule_name, count</LI-CODE> <P>This works perfectly for the past 48 hours but it doesn't go back as far as a week (a known limitation when using es_notable_events apparently!). My question is, are there any altenative searches that I can run that will get these results?</P> Wed, 22 Jan 2025 19:22:45 GMT greenpebble 2025-01-22T19:22:45Z https://community.splunk.com/t5/Splunk-Enterprise-Security/es-notable-events-Query/m-p/709495#M12261 <P>Hi folks,</P> <P>Looking to use&nbsp;es_notable_events as a way of building out a panel that will get info on ES events for the past 7 days, specifically how many alerts were closed by the team and what the alert name is. The search I am using is as follows:</P> <LI-CODE lang="markup">| `es_notable_events` | search timeDiff_type=current | stats sparkline(sum(count),30m) as sparkline,sum(count) as count by rule_name | sort 100 - count | table rule_name, count</LI-CODE> <P>This works perfectly for the past 48 hours but it doesn't go back as far as a week (a known limitation when using es_notable_events apparently!). My question is, are there any altenative searches that I can run that will get these results?</P> Wed, 22 Jan 2025 19:22:45 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/es-notable-events-Query/m-p/709495#M12261 greenpebble 2025-01-22T19:22:45Z