We're currently using Splunk ES, and would like to grab the link to a notable event's drilldown link on the ES Incident Review page without having to manually copy it.
The closest solution that I've come across is automatically building the URL by using a `notable` search and piecing together the earliest/latest times and drilldown search, but I feel like there might be a more elegant solution out there.
Found that using the orig_sid in the notable's event fields can provide the indirect link to the drilldown.
Ex. localhost:8000/en-US/app/SplunkEnterpriseSecuritySuite/search?sid=<orig_sid>
Found that using the orig_sid in the notable's event fields can provide the indirect link to the drilldown.
Ex. localhost:8000/en-US/app/SplunkEnterpriseSecuritySuite/search?sid=<orig_sid>