Custom Notable Event Statuses causes PCI app to not work correctly

[kmanson]

We currently use custom notable event status fields (Closed False Positive and Closed Validated Incident) not the default closed field. When using these custom fields the drill downs from the posture dashboards do not work. It only searches for a status of Closed, so no results return in the incident review.

Splunk 6.3.2
ES 4.0.1
PCI app 3.0.1

[jkat54]

You'll need to edit the views so that different drop downs are available. Please file a case with Splunk since this is Splunk supported and not community supported.

http://www.splunk.com/index.php/submit_issue