topic Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket? in Splunk Search

How to write a search to display a Notable Event Timeline Review showing various phases of a ticket?

gschauhan81 — Mon, 08 Jun 2020 17:48:36 GMT

Hello everyone

Can anyone suggest me a search where I can get the notable Event time review between various phases of a ticket like Unassigned, in Progress, pending, resolved, and closed?

It should be like a table with a row of all notable event titles, column as status, and filling the table will be timestamps for all the statuses entered.

Any suggestions to get this kind of result?

Regards
Gaurav Chauhan

Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket?

gschauhan81 — Mon, 01 Aug 2016 17:10:54 GMT

43 views and nobody answering, do i need to need to address to anyone specific

Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket?

Raschko — Mon, 01 Aug 2016 17:16:30 GMT

Do you have some sample events to work with? Furthermore, do you already have any field extractions on/from the events?

Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket?

jstoner_splunk — Tue, 29 Sep 2020 10:28:06 GMT

This may not be an exact fit but might get you on the way

|`incident_review`  | rename status_label as status |stats values(rule_name), values(status), values(_time) by rule_id |rename values(_time) AS time

This would group the rule_id which is the key piece of grouping a notable event, bringing along the name of the correlation search and then grouping the status and pulling in the time for each status being reached.

This would only cover events that have changed status from unassigned because they are pulling from the audit index to get the changes in review state.
index=_audit sourcetype="incident_review"

To get all of the other notable events that are unassigned, you could do something like this:

|`es_notable_events` |where status = 1 |table rule_name, status_group, _time |`hourDiff(_time)`

This would give you all notable events that are in unassigned status and output the rule name, the time the event occurred and if you wanted to look at how many hours it has been while it is still unassigned you could use the macro hourDiff.

From there, you could do these as sub searches and use appendcols to pull it together.

This probably doesn't fully answer your question in the exact format you want but hopefully it is a step in the right direction.

BTW, incident_review and es_notable_events are macros. For some reason, it does not want to render correctly.

Thanks
john

Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket?

fwijnholds_splu — Wed, 03 Jun 2020 20:49:09 GMT

This has it shows half of the answer.

You should use the notable macro
notable | timechart count by rule_name

https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/notableeventsplunkes/usingnotableeventsinsearch

Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket?

splunkreal — Mon, 13 May 2024 13:35:34 GMT

Hello @jstoner_splunk @fwijnholds_splu I'm finding different results filtering in Incident Review, is that normal? Thanks.