topic Splunk Enterprise Security: How to set up alerts when a notable event with urgency High & Critical arises in the Incident review? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-set-up-alerts-when-a-notable/m-p/265252#M2020 <P>Hi</P> <P>How to set up alerts when a notable event with urgency High &amp; Critical arises in the Incident review with event details?</P> Tue, 19 Jul 2016 14:30:12 GMT kiran331 2016-07-19T14:30:12Z Splunk Enterprise Security: How to set up alerts when a notable event with urgency High & Critical arises in the Incident review? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-set-up-alerts-when-a-notable/m-p/265252#M2020 <P>Hi</P> <P>How to set up alerts when a notable event with urgency High &amp; Critical arises in the Incident review with event details?</P> Tue, 19 Jul 2016 14:30:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-set-up-alerts-when-a-notable/m-p/265252#M2020 kiran331 2016-07-19T14:30:12Z Re: Splunk Enterprise Security: How to set up alerts when a notable event with urgency High & Critical arises in the Incident review? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-set-up-alerts-when-a-notable/m-p/265253#M2021 <P>This is what i used. Hopefully this can help you out.</P> <PRE><CODE>`notable` | where urgency="high" OR urgency="critical" | table _time source src dest user | eval computer=coalesce(src,dest) </CODE></PRE> Thu, 17 Nov 2016 16:08:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-How-to-set-up-alerts-when-a-notable/m-p/265253#M2021 mwhittaker126 2016-11-17T16:08:29Z