Splunk Enterprise Security

In Splunk ES how do I create a search to find all unassigned and assigned owners to a rule/title

New Member

Hi all.

Our Incident review page is getting needlessly large and I want to create a dashboard that will populate with a select few  rules_names or titles that I can see in the incident review tab in Splunk ES.




| fields - time





for example shows me fields that are useful because I also get the _time, owner/reviewer, rule_name and status. What I am looking for is all that and including the rules that came in and are also unassigned to an owner.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...