Splunk Enterprise Security

How do I delete incidents from Splunk ES


Hello Splunkers,
ES was recently deployed in our environment and some incidents were created as part of testing functionality. I now have a bunch of erroneous incidents that are messing with my data. How do I delete them and clean the slate?


Re: How do I delete incidents from Splunk ES

Splunk Employee
Splunk Employee

If you are referring to the Notable events, these are managed through the Incident Review framework in ES. You select the events and edit them, from there you can change the status of the events to closed. See the documentation at :


If you want to delete the events completely, this is a bit more complex as the Notables are stored in a combination of the Notables index, and on local lookup files on the ES SH.