https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Event-Tags/m-p/292994#M2568 <P>figured it out.... i was creating tags in the search app instead of the ES app =/</P> Thu, 09 Feb 2017 20:19:28 GMT ErraticIncome93 2017-02-09T20:19:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Event-Tags/m-p/292993#M2567 <P>I am trying to assign custom tags to notable events so that they can be triaged by certain analysts, i.e., tier 1. I have a cron scheduled search created and it is set to create notable events; this works fine. I then setup a corresponding tag for that search_name but when I try to filter by the tag name in the tag field in the Incident Review dashboard it does not show up.</P> <P>scheduled search (search name is _triage_test) that is working and generates a notable: <CODE>index=snort signature="test rule"</CODE><BR /> tag (tag name is _use_case_test) that is not working: <CODE>search_name=_triage_test</CODE></P> <P>Any ideas? Thanks.</P> Tue, 29 Sep 2020 12:49:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Event-Tags/m-p/292993#M2567 ErraticIncome93 2020-09-29T12:49:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Event-Tags/m-p/292994#M2568 <P>figured it out.... i was creating tags in the search app instead of the ES app =/</P> Thu, 09 Feb 2017 20:19:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Event-Tags/m-p/292994#M2568 ErraticIncome93 2017-02-09T20:19:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Event-Tags/m-p/292995#M2569 <P>If your problem is solved, please accept the answer.</P> Thu, 09 Feb 2017 22:11:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Event-Tags/m-p/292995#M2569 richgalloway 2017-02-09T22:11:22Z