Easy notables search - top owners and top alerts per owner

[conma293]

Not sure why this is so hard...

Wana go back say 7/30/90 days and stats count number of alerts per analyst. Ie who closed out the top or top true positives etc

Then want the ability to drill in and do stats count on any specific analysts for what those alerts were by rule/alert/notable name... To see what they were mainly dealing with

Why is this so hard...

[lkutch_splunk]

Sounds like you could use the Incident Review Audit Dashboard:
https://docs.splunk.com/Documentation/ES/6.6.0/User/Audit#Incident_Review_Audit

or the Investigation Overview Dashboard:
https://docs.splunk.com/Documentation/ES/6.6.0/User/Audit#Investigation_Overview

Let me know if that helps.