Splunk Enterprise Security

Can you customize Additional Fields in Notable Events?


Is there a way to customize which additional fields to show for which Notable event /Co-relation search without affecting other notable events that may be displaying the same additional fields? If so, please help.



i figured there were no other magic ways without it affecting other notable events. Thank you for responding!

Path Finder

You're welcome.

0 Karma

Path Finder

Firstly, we need to make sure that the correlation search results include the field and then make sure that Incident Review can display the field.

Some fields are consistent for all notable events and each notable event returns different additional fields depending on the syntax of the correlation search.  To be specific on your question, we can't customize the fields for each notables, any changes that you make to notable event fields affect all notable events.

The best you can do is remove the unwanted annotations fields and consider displaying important fields like user/srcip,destip,port, filepath etc.

To add the field to the list of additional fields for a notable, you can follow the below steps.

  • From the Splunk Enterprise Security menu bar, select Configure > Incident Management > Incident Review Settings.
  • Click Add new entry to add the new field to the Additional Fields section of the notable event details.
  • Type a Label to use as the display name of the field in the notable event details.
  • Type a Field to match the field that you want to appear in the notable event details.
  • Click Done & Save.

Hope this helps and trying to assist you with what I know. 

For reference : 

Customize notable event settings in Splunk Enterprise Security - Splunk Documentation

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...