Archive

Splunk Enterprise Security: Is there a way to Auto-Populate the name field with a custom nomenclature?

gworkun
Explorer

Quick question about Splunk ES:

On version 4.7.4 I am curious if there was a way to do this. On Investigations, we are going to add a new Investigation Journal/Investigation. Is there a way to populate the name field with a custom nomenclature? We wanted to generate Investigation names programmatically where possible to keep things consistent, like adding the date/custom character set each time or iterate by 1 or some interval to ensure names are correct.

If there's something in a .conf file to adjust or if it's just not currently possible, any advice is helpful. Thanks!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!