Hi All,
Recently a question came up about notifying a client on high urgency notable events. I want to send out an auto email anytime there's a high urgency notable event. It's easy to write a search that checks for high urgency notable events and send an email. However, I also want to be able to change the status of these notables within the same search as I send the email (Client Notified, or something similar). Is there a simple way to do this? I'd even settle for a complicated way 🙂
Thanks for reading!
Hello @splunkbunk, You can update the urgency under incident_review_lookup once you run the saved search that notifies users.