Splunk Enterprise Security

Customize Notable Status Order in Dropdown

BenjaminWyatt
Communicator

Hi everyone,

   I have a request from our security team to reorder our notable event statuses in the dropdown. We have a lot of custom statuses that supplant the "In Progress" label, and at present they all appear at the very end of the dropdown list, which isn't terribly convenient for our analysts. I can see how to edit the status names, but I can't find a way to change the order the appear in the dropdown. Is there a way to do this? 

Labels (2)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

are you talking about Status input in incident review? if yes, we can't do much customization about Incident review.

————————————
If this helps, give a like below.
0 Karma

BenjaminWyatt
Communicator

Yes, that's the one - sounds like that won't be a possibility then. 

Out of curiosity, what is the default ordering for statuses in the dropdown? It looks like they are listed by order of their status ID, but it would be good to confirm. 

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...