Displaying an investigation on the Incident Review Dashboard

[adnankhan5133]

If I decided to create an Investigation in Splunk ES via the Investigation Workbench from the Investigations page ("Create new Investigation"), could I also create a new notable event associated to that Investigation?

I'm trying to see if there is a way to display an investigation on the Incident Review dashboard since we are leveraging that dashboard for reporting purposes.

[lkutch_splunk]

Yes, you can do that. You can start an investigation & then you can manually create a notable event called "started an investigation" (or whatever you like): 

https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Createnotablesmanually#Create_a_notable_event_f...

& you can see it in Incident Review & add it to your investigation.