How to set Notable Event Status Via Search?

[splunkbunk]

Hi All,

Recently a question came up about notifying a client on high urgency notable events. I want to send out an auto email anytime there's a high urgency notable event. It's easy to write a search that checks for high urgency notable events and send an email. However, I also want to be able to change the status of these notables within the same search as I send the email (Client Notified, or something similar). Is there a simple way to do this? I'd even settle for a complicated way 🙂

Thanks for reading!

[meetmshah]

Hello @splunkbunk, You can update the urgency under incident_review_lookup once you run the saved search that notifies users.