https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-security/m-p/497591#M8677 <P>in my Splunk ES i want to find below search</P> <OL> <LI>Count of New Notables created in last 30 days</LI> <LI>Count of Modified Correlation Searches in last 30 days</LI> <LI>Time of Notable Closure </LI> </OL> <P>Can some one help in sending search please..</P> <P>Thanks in advance </P> Wed, 18 Mar 2020 20:26:14 GMT vikram1583 2020-03-18T20:26:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-security/m-p/497591#M8677 <P>in my Splunk ES i want to find below search</P> <OL> <LI>Count of New Notables created in last 30 days</LI> <LI>Count of Modified Correlation Searches in last 30 days</LI> <LI>Time of Notable Closure </LI> </OL> <P>Can some one help in sending search please..</P> <P>Thanks in advance </P> Wed, 18 Mar 2020 20:26:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-security/m-p/497591#M8677 vikram1583 2020-03-18T20:26:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-security/m-p/497592#M8678 <P>1: Count of New Notables created in last 30 days (run this for <CODE>Last 30 days</CODE> on the <CODE>Timepicker</CODE>:</P> <PRE><CODE>`notable` | search eventtype!="notable_suppression*" </CODE></PRE> <P>2: Count of Modified Correlation Searches in last 30 days. This is NOT a full answer, but a starting place:</P> <PRE><CODE>index="_audit" AND sourcetype="audittrail" AND savedsearch_name="*" </CODE></PRE> <P>3: Time of Notable Closure</P> <PRE><CODE>`notable` | search status_label="closed" </CODE></PRE> Thu, 19 Mar 2020 02:29:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-security/m-p/497592#M8678 woodcock 2020-03-19T02:29:39Z