https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494043#M8464 <P>Thanks @richgalloway for quick response.</P> <P>Yes I understand my upgrade path is not direct. </P> <P>The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or </P> <P>First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.</P> <P>I am now confused what to upgrade first.</P> Tue, 12 May 2020 19:04:00 GMT thambisetty 2020-05-12T19:04:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494041#M8462 <P>When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available</P> <UL> <LI>Status</LI> <LI>Change urgency</LI> <LI>Owner</LI> <LI>Description Summary/Notes</LI> </UL> <P>Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.</P> <UL> <LI>Status</LI> <LI>Change urgency</LI> <LI>Owner</LI> <LI>Category</LI> <LI>Description Summary/Notes</LI> </UL> Sun, 07 Jun 2020 16:20:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494041#M8462 thambisetty 2020-06-07T16:20:23Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494042#M8463 <P>Your upgrade path will not be direct. You will need to upgrade ES to version 5 before installing ES 6. See <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_version_8.0">https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_version_8.0</A> for the path to upgrade ES.<BR /><BR /> Be sure to run the Splunk Platform Readiness app (<A href="https://splunkbase.splunk.com/app/4698/">https://splunkbase.splunk.com/app/4698/</A>) before installing Splunk 8 to make sure all of your Python scripts will be compatible.</P> Tue, 12 May 2020 18:25:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494042#M8463 richgalloway 2020-05-12T18:25:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494043#M8464 <P>Thanks @richgalloway for quick response.</P> <P>Yes I understand my upgrade path is not direct. </P> <P>The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or </P> <P>First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.</P> <P>I am now confused what to upgrade first.</P> Tue, 12 May 2020 19:04:00 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494043#M8464 thambisetty 2020-05-12T19:04:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494044#M8465 <P>ES can run on an unsupported version of Splunk for a short time. "Short" means "until we upgrade again later today".</P> Tue, 12 May 2020 19:18:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/494044#M8465 richgalloway 2020-05-12T19:18:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/520478#M9285 <P>answers are not related to question. I think this is the problem after migration from answers.splunk.com to community.splunk.com&nbsp;</P> Sun, 20 Sep 2020 09:49:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/SPLUNK-ES-Notable-Event-Closure/m-p/520478#M9285 thambisetty 2020-09-20T09:49:14Z