Notable Event Urgency issues

[04cjm]

I have setup a few correlated events which currently are showing up in the incident review console as urgency (unknown) if you "Uncheck" all the Urgency levels. I have checked the searches and it has the correct input. I also setup it up so all three values eval to "high" (priority,severity,urgency) but it still only fires as high as a "medium" event. Does anyone know what could be causing these events now to show up as high. I have reviewed the articles about how urgency is assigned and the lookup table is fine it actually says it should be set to high but its still not doing it.

[jet1276]

Due to same names in the ES App and your correlation search the severity values will be overwritten.

Check if you have any other field as "severity" in the correlation search output. If so then just rename the field to something else. Your problem should be resolved after.

[dsrvern]

It would be nice if Splunk had a bug tracker where folks could report issues and enhancement requests. The urgency issue has affected us for 4-5 months now, but I have no way to report it to Splunk since 1) I'm not the direct customer, and 2) the customer hasn't added me to their account such that I can report issues (and not for lack of effort on my part for several months).

I have no idea how the "urgency" is getting set to "unknown". This happens for at least 2 of our correlation searches, but not others. I've read the Splunk docs, which haven't been helpful in this particular case. By all appearances, this is a bug.

[infosecb]

What is the sourcetype of the logs you are searching in the correlation search?

If they are Windows logs and you have the Windows TA installed, the TA will add a "severity" alias to Windows logs. The severity added by the TA will interfere with the ES severity that determines the Notable urgency.

The simple fix is to only include the fields you need in the correlation search and make sure not to select the "severity" field.