Splunk Enterprise Security

ES Investigation Note Formatting


When you create notes in Splunk ES you can format the notes with tabs and carriage returns.  When the note saves and is shown in a slide or expanded on the timeline the text is all mashed together.  Is there a way to retain the note formatting in the slides/timeline?

Labels (1)

New Member


Was a solution ever found?  I am experiencing this, a Note in an investigation is easier to read in Edit mode than after its published.  When published, it looks like one runon sentence, no spacing, no formatting.

Thanks in advance!


0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...