Splunk Enterprise Security
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

How to retrieve a specific alert in Splunk Enterprise security apart from using Short ID method?

nelaturivijay
Observer
‎10-01-2023 06:08 PM

Hi All,

Is there a way to retrieve a specific alert without using short ID in the incident review page?

I was thinking of using "rule_id" field or "event_hash" of the alert, but couldn't be able to pull the specific alert.

Please suggest any other alternate method other than using short id.

Thanks.

Labels (1)
Labels
0 Karma
Reply
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...