Can i get all the related events when an notable as been created ?

[nandha_2]

I have configured "Correlation Search" and I would like to grab all the related events for that notable (by skipping the drilldown search option) . ? is that possible ?

[jstoner_splunk]

Can you help me understand a bit more how you would envision this to be viewed? From the Incident Response screen, the analyst has the flexibility to go to the drill-down, but also allow them to pivot to other context enrichment and other dashboards instead. Are you asking about getting all related events via that Incident Response screen or potentially creating your own search/dashboard?

[nandha_2]

Sure, When I create correlation search it creates notables. once the notables is created in the "index notable" i do a couple of things:

1) I used "Run a script" option to send the notables to another server called "A".

2) Now "A" receives all the notables and it will search for the related events (aka) drilldown search to get all the related events for that incident.

its painful process to do it, when i get a 10K incidents per day. what i request:

1) is there any way for me to pull the events when the notable is created, so A needn't do a push method to retrieve all the related events per incidents.

What i think:
Splunk already should store all the events in memory and once the events are matched by the c.search a notables is created, can i grab that events along with the incidents ?

[jstoner_splunk]

At this point the approach where you pull the notables and then issue drill-downs to get greater specificity may be the best approach. You could have a script run when a notable is created that runs the drill down search for that criteria automatically though.