https://community.splunk.com/t5/Splunk-Enterprise-Security/where-to-check-notable-status-not-from-ES-app-but-from-logs/m-p/366068#M3628 <P>Hello,</P> <P>My question is regarding "Splunk App for Enterprise Security". </P> <P>This app will trigger Notables and logging at index=Notable</P> <P>Once I have change the status of a notable to inprogress Or pending, where it logged?</P> <P>I would like to make a search query to find out from past 1 month how my team responded/closed the notables.</P> <P>could you please help.</P> Tue, 13 Feb 2018 10:43:33 GMT srisahitya_v 2018-02-13T10:43:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/where-to-check-notable-status-not-from-ES-app-but-from-logs/m-p/366068#M3628 <P>Hello,</P> <P>My question is regarding "Splunk App for Enterprise Security". </P> <P>This app will trigger Notables and logging at index=Notable</P> <P>Once I have change the status of a notable to inprogress Or pending, where it logged?</P> <P>I would like to make a search query to find out from past 1 month how my team responded/closed the notables.</P> <P>could you please help.</P> Tue, 13 Feb 2018 10:43:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/where-to-check-notable-status-not-from-ES-app-but-from-logs/m-p/366068#M3628 srisahitya_v 2018-02-13T10:43:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/where-to-check-notable-status-not-from-ES-app-but-from-logs/m-p/366069#M3629 <P>it’s in the kvstore</P> <P>They have macros to help you retrieve the data:</P> <P><A href="http://dev.splunk.com/view/enterprise-security/SP-CAAAFBA">http://dev.splunk.com/view/enterprise-security/SP-CAAAFBA</A>. </P> <P>I believe you’re looking for incident_review:</P> <PRE><CODE> | `incident_review` </CODE></PRE> Tue, 13 Feb 2018 11:33:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/where-to-check-notable-status-not-from-ES-app-but-from-logs/m-p/366069#M3629 jkat54 2018-02-13T11:33:34Z