Is it possible for an alert outside of the Splunk ES app to create and push notable events to Splunk ES?

[hettervik]

Hi.

We've just installed Splunk ES and want to utilize the notable event functions. I know there is some correlation searches out-of-the-box, but we also have quite a few alerts already sat up in an existing app. As of now the app with the existing alerts lies on the same search head as Splunk ES. If we try to edit one of the "alert actions" for one of the alerts in the app we indeed get an option for named "Notable", which seems to be the same notable event correlation search action that Splunk ES uses, but there is no further options available. That is, we can't set either the severity, related assets, or related users for the notable event, nothing.

Does anyone know if it's possible to create a notable event from an alert outside of the Splunk ES app, and if so, how?

[jawaharas · Accepted solution]

Good question!

Yes, you can create notable events outside of Splunk ES app. But as you said, there is no option to edit severity and other usual fields of a notable alert. By default, a 'low' severity notable alert will be created.

The best approach is to use 'Correlation Search' in ESS to create notable event from an alert.

[jawaharas]

Can you upvote and accept the answer if it's helped you? Thanks.

[hettervik]

Thanks! Do you know if it's possible to edit the severity and other fields of the notable events in the stanza for the alert in savedsearches.conf? I guess it's no problem to move all my existing alerts into the Splunk ES app, but it is a bit of a hassle.

[jawaharas]

I have tried add below parameter to 'savedsearches.conf'. But 'severity' of notable alert is still 'low'.

action.notable.param.severity = high

Better to raise a case with Splunk support team.