Knowledge Management

Additional field - event acknowledgment

kkuminsky
Path Finder

Is there a way to add an additional field to every event for acknowledgment?

I'm analyzing failed login attempts. As some of them happened for a known reason I'd like to mark them somehow in the final report.

Tags (2)

araitz
Splunk Employee
Splunk Employee

Yes, we need this!!!

0 Karma

ftk
Motivator

I am doing something similar to what you're trying to do -- basically I am tagging events in splunk with change ticket numbers using lookups. You should be able to tune this to your requirements:

http://answers.splunk.com/questions/3982/correlate-and-tag-splunk-events-with-change-control-tickets

netwrkr
Communicator

This sure would be a nice feature.

Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...