Knowledge Management

Additional field - event acknowledgment

kkuminsky
Path Finder

Is there a way to add an additional field to every event for acknowledgment?

I'm analyzing failed login attempts. As some of them happened for a known reason I'd like to mark them somehow in the final report.

Tags (2)

araitz
Splunk Employee
Splunk Employee

Yes, we need this!!!

0 Karma

ftk
Motivator

I am doing something similar to what you're trying to do -- basically I am tagging events in splunk with change ticket numbers using lookups. You should be able to tune this to your requirements:

http://answers.splunk.com/questions/3982/correlate-and-tag-splunk-events-with-change-control-tickets

netwrkr
Communicator

This sure would be a nice feature.

Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...