Splunk Enterprise Security

Manual Notable Tittle

prashanthberam
Explorer

I was trying to create a manual notable event using "sendalert notable". But the name of the notable is coming as "Manual Notable Event- Rule". How can I name the notable to exactly what I want?
Please note that I want to create the notable through sendalert only.

Labels (1)
Tags (1)

ericjorgensenjr
Path Finder

I'm not sure that this is possible without modifying the underlying alert action or cloning it and creating a modified version.

However, there is a workaround that can provide similar functionality without using an alert action:

| makeresults | eval somefield="Some text", search_name="SearchName", source=search_name | collect index=notable source="SearchName"

 

glados
Engager

Did you ever find a solution? I am wondering the same thing. I see that we can control certain fields such as urgency via the sendalert notable command but the name/title field is eluding me.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...