How to find source and sourcetype of notable

[DawoodKhanUlex]

Hi Folks,

I want find all source and sourcetype for enable notables in Splunk ES.

Please advise.

Regards,

D

[ololdach]

Hi, the way I understand your question is that you are looking for the configuration file with the definition of the source and the sourcetype for the events in the notable index of ES. The answer to that question is: There are none. The notable index is being populated through correlation searches that end in a ...| collect ... command that writes the result of the correlation search to the notable index. See this page for more information on how to use collect to write data to an index:  https://docs.splunk.com/Documentation/SplunkCloud/8.1.2008/SearchReference/Collect

Cheers

Oliver

[lkutch_splunk]

Did you try a search for index=notable & then see the source and sourcetype as selected fields or interesting fields in the results?