Splunk Enterprise Security

Notable Event Urgency issues


I have setup a few correlated events which currently are showing up in the incident review console as urgency (unknown) if you "Uncheck" all the Urgency levels. I have checked the searches and it has the correct input. I also setup it up so all three values eval to "high" (priority,severity,urgency) but it still only fires as high as a "medium" event. Does anyone know what could be causing these events now to show up as high. I have reviewed the articles about how urgency is assigned and the lookup table is fine it actually says it should be set to high but its still not doing it.

Path Finder

Due to same names in the ES App and your correlation search the severity values will be overwritten.

Check if you have any other field as "severity" in the correlation search output. If so then just rename the field to something else. Your problem should be resolved after.

0 Karma


It would be nice if Splunk had a bug tracker where folks could report issues and enhancement requests. The urgency issue has affected us for 4-5 months now, but I have no way to report it to Splunk since 1) I'm not the direct customer, and 2) the customer hasn't added me to their account such that I can report issues (and not for lack of effort on my part for several months).

I have no idea how the "urgency" is getting set to "unknown". This happens for at least 2 of our correlation searches, but not others. I've read the Splunk docs, which haven't been helpful in this particular case. By all appearances, this is a bug.

0 Karma

New Member

What is the sourcetype of the logs you are searching in the correlation search?

If they are Windows logs and you have the Windows TA installed, the TA will add a "severity" alias to Windows logs. The severity added by the TA will interfere with the ES severity that determines the Notable urgency.

The simple fix is to only include the fields you need in the correlation search and make sure not to select the "severity" field.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...