Splunk Enterprise Security

Add a comment field to an event

nate015
Explorer

A user would like to click on the down arrow to the left of an event and leave a comment. I think I have seen this demoed in ESS. Is there a simple way to implement it?

1 Solution

Lowell
Super Champion

I don't know anything about the ESS app myself, but I think you may find the following discussions helpful:


A possible "hack" for annotating transactions (used in combination with the methods described in the above links):

... | transaction your-txn-options mvlist="splunk_server,index,_cd" | eval splunk_server=mvindex(splunk_server,0) | eval index=mvindex(index,0) | eval _cd=mvindex(_cd,0) | lookup mylookup splunk_server index _cd OUTPUT my_txn_note

This trick will only work if your transaction command is guaranteed to always have the exact same first event.

View solution in original post

Lowell
Super Champion

I don't know anything about the ESS app myself, but I think you may find the following discussions helpful:


A possible "hack" for annotating transactions (used in combination with the methods described in the above links):

... | transaction your-txn-options mvlist="splunk_server,index,_cd" | eval splunk_server=mvindex(splunk_server,0) | eval index=mvindex(index,0) | eval _cd=mvindex(_cd,0) | lookup mylookup splunk_server index _cd OUTPUT my_txn_note

This trick will only work if your transaction command is guaranteed to always have the exact same first event.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You could use a concatencation of the _cd values as your key if you must, and split it to get your items back. It should be available via eval f=mvjoin(_cd,";") for example.

0 Karma

Lowell
Super Champion

Yeah. It sounds like the ability to annotate events (or transactions, in your specific case) is on the radar, but making splunk aware of your specific use case with an ER is certainly good idea. In the mean time, if your transaction events always start with the same event, you could do some filtering to make sure you always just select the first _cd value. It's kind of a hack, but the whole thing is a hack anyways...

0 Karma

nate015
Explorer

Thanks for the links Lowell, unfortunately I don't think they will work for me since I'm using the "transaction" operator (which will have multiple _cd values).

What I'm doing is running a search that looks at all the commands logged by a user on a networking device and puts them into a single transaction. The user then needs to put an explanation and a ticket number to go along with the transaction. I'll open an enhancement request.

0 Karma