How to retrieve a specific alert in Splunk Enterprise security apart from using Short ID method?

[nelaturivijay]

Hi All,

Is there a way to retrieve a specific alert without using short ID in the incident review page?

I was thinking of using "rule_id" field or "event_hash" of the alert, but couldn't be able to pull the specific alert.

Please suggest any other alternate method other than using short id.

Thanks.