Solved: Hide specific notables from IR (Incident review) i...

splunkreal

Hello, we would like to filter ES incident review and hide notables with TEST keyword by example, how to do? Thanks for your help

* If this helps, please upvote or accept solution if it solved *

jawahir007

Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.

search_name!=*TEST*

------

jawahir007

You can achieve this by creating Custom Notable Event Suppressions. Please refer to the link below for more details.

------

splunkreal

Hi @jawahir007 we don't want to suppress them just hide them based on saved filter.

* If this helps, please upvote or accept solution if it solved *

jawahir007

Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.

search_name!=*TEST*

------

splunkreal

Great thanks, it works with classic IR view 🙂

* If this helps, please upvote or accept solution if it solved *

Hide specific notables from IR (Incident review) in ES