Enterprise Security: why the incidents don't show up in the lookup?

[danielbb]

With all the help from @solarboyz1, the correlation searches produce now notable events, which show up in the Incident Review page.

index=notable shows them but | inputlookup incident_review_lookup shows zero results.

Why is that?

[jawaharas]

Once you assign the notable event/incident to an user, you can notice records in incident_review_lookupfile.

[danielbb]

Right, just saw it running and | inputlookup incident_review_lookup shows the assigned incident.

[solarboyz1 · Accepted solution]

The state and ownership information are stored in the incident_review_lookup

Until an action is taken on the notable, I don't believe anything will stored for it in incident_review_lookup

http://dev.splunk.com/view/enterprise-security/SP-CAAAFA9