How can we search the notables using short id as filter in incident dashboard on Splunk ES?

[abhijitnath89]

Hi All,

I am using Splunk ES. We create short Ids for notables.

How can we search the notables using short id as filter in incident dashboard on Splunk ES.

[johnvdzon]

Within the ES app.
Select "Incident Review" 
Look for the filter "Time or Associations",  select Associations
A new filter option will appear. "Short ID" 
Move 1 filter to the right with the name "Select". If you select this one, you can enter or select the Short ID you are looking for.

[KKuser]

The method you are saying works for Splunk Enterprise version 7.2.0 and lower. The short ID filter is not available by default once you upgrade to Splunk Enterprise Security version 7.3.0. 

Follow the steps for reference: https://docs.splunk.com/Documentation/ES/7.3.0/Admin/CustomizeIR#Create_a_short_ID_column_to_filter_...