How to Mark ES incident or alert as True/False Pos...

Alerting

Hi Team,

Requirement : ES incident/Alerts should be mark as True Positive or False Positive as verdict .

Please help how I can fulfill this requirement,.

Is there any custom field configuration or any drop down list can be configured ?

Get Updates on the Splunk Community!

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Watch Now! In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

How to Mark ES incident or alert as True/False Positive in Splunk cloud