Additional field - event acknowledgment

[kkuminsky]

Is there a way to add an additional field to every event for acknowledgment?

I'm analyzing failed login attempts. As some of them happened for a known reason I'd like to mark them somehow in the final report.

[araitz]

Yes, we need this!!!

[ftk]

I am doing something similar to what you're trying to do -- basically I am tagging events in splunk with change ticket numbers using lookups. You should be able to tune this to your requirements:

http://answers.splunk.com/questions/3982/correlate-and-tag-splunk-events-with-change-control-tickets

[netwrkr]

This sure would be a nice feature.