Knowledge Management

Additional field - event acknowledgment

kkuminsky
Path Finder

Is there a way to add an additional field to every event for acknowledgment?

I'm analyzing failed login attempts. As some of them happened for a known reason I'd like to mark them somehow in the final report.

Tags (2)

araitz
Splunk Employee
Splunk Employee

Yes, we need this!!!

0 Karma

ftk
Motivator

I am doing something similar to what you're trying to do -- basically I am tagging events in splunk with change ticket numbers using lookups. You should be able to tune this to your requirements:

http://answers.splunk.com/questions/3982/correlate-and-tag-splunk-events-with-change-control-tickets

netwrkr
Communicator

This sure would be a nice feature.

Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...