Splunk Enterprise Security

How can I test for high or critical notable events?

Path Finder

I have read this article which describes searching for high or critical notable events.


notable | where urgency="high" OR urgency="critical" | table _time source src dest user | eval computer=coalesce(src,dest)

Now i need a simple way to create a critical notable event to test.

How best to achieve this ?


0 Karma

Splunk Employee
Splunk Employee

You can also create a manual notable event in the UI. https://docs.splunk.com/Documentation/ES/4.7.2/Admin/Createnotablesmanually

0 Karma


I had to do something like this today try the following:

| makeresults 
| eval user="skins", urgency="critical" 
| sendalert notable
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!