- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunkreal
Motivator
10-25-2024
01:12 AM
Hello, we would like to filter ES incident review and hide notables with TEST keyword by example, how to do? Thanks for your help
* If this helps, please upvote or accept solution if it solved *
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jawahir007
Communicator
10-25-2024
02:16 AM
Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.
search_name!=*TEST*
------
If you find this solution helpful, please consider accepting it and awarding karma points !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jawahir007
Communicator
10-25-2024
01:48 AM
You can achieve this by creating Custom Notable Event Suppressions. Please refer to the link below for more details.
------
If you find this solution helpful, please consider accepting it and awarding karma points !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunkreal
Motivator
10-25-2024
01:55 AM
Hi @jawahir007 we don't want to suppress them just hide them based on saved filter.
* If this helps, please upvote or accept solution if it solved *
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jawahir007
Communicator
10-25-2024
02:16 AM
Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.
search_name!=*TEST*
------
If you find this solution helpful, please consider accepting it and awarding karma points !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunkreal
Motivator
10-25-2024
02:25 AM
Great thanks, it works with classic IR view 🙂
* If this helps, please upvote or accept solution if it solved *
