How to Mark ES incident or alert as True/False Pos...

Alerting

Hi Team,

Requirement : ES incident/Alerts should be mark as True Positive or False Positive as verdict .

Please help how I can fulfill this requirement,.

Is there any custom field configuration or any drop down list can be configured ?

Get Updates on the Splunk Community!

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

How to Mark ES incident or alert as True/False Positive in Splunk cloud