Hide specific notables from IR (Incident review) in ES

[splunkreal]

Hello, we would like to filter ES incident review and hide notables with TEST keyword by example, how to do? Thanks for your help

[jawahir007]

You can achieve this by creating Custom Notable Event Suppressions. Please refer to the link below for more details.

https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Customizenotables#Create_and_manage_notable_eve...

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

[splunkreal]

Hi @jawahir007  we don't want to suppress them just hide them based on saved filter.

[jawahir007 · Accepted solution]

Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.

search_name!=*TEST*

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

[splunkreal]

Great thanks, it works with classic IR view 🙂