Splunk Enterprise Security

ES Investigation Note Formatting


When you create notes in Splunk ES you can format the notes with tabs and carriage returns.  When the note saves and is shown in a slide or expanded on the timeline the text is all mashed together.  Is there a way to retain the note formatting in the slides/timeline?

Labels (1)

New Member


Was a solution ever found?  I am experiencing this, a Note in an investigation is easier to read in Edit mode than after its published.  When published, it looks like one runon sentence, no spacing, no formatting.

Thanks in advance!


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...