I would imagine this happens to a lot of people. Sometimes we have two analysts picking up the same ticket. Maybe they refreshed the page at about the same time or perhaps the second analyst forgot to refresh the incident review page. Splunk is not providing any type of input validation telling the second analyst the alert status already changed from new to in progress.
Obviously at some point the first analyst will notice someone else stole his ticket or the second analyst may see the history and realize the first guy is already working the issue. The point is, an analyst may waste half an hour duplicating work.
I was hoping for some feedback on how other people are dealing with this issue?
