Notable event isn't created.

[kanam]

Now I enable correlation search, which is set "Notable" and "Run Phantom Playbook" as adaptive action.

Then when logs are found, "Run Phantom Playbook" is run normally, 

but "Notable" doesn't look to be run and "Incident Review" doesn't show anything.

I confirm the result of SPL "index=notable", it returns no result.

Please help.

[lkutch_splunk]

Does this help? 
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Troubleshootnotables

[kanam]

Thank you.

I couldn't fine any logs as results of "index=_internal sourcetype=notable_modalert".

I guess trigger action isn't worked successfully.

However another adaptive action, "Run Phantom Playbook", is running well.

[scelikok]

Hi @kanam,

I think your notable index is empty. If you are using a distributed architecture you may have missed creating "notable" index on your cluster. ES installation creates that index on the search head but the indexes conf that comes with ES must have been also deployed to indexers too. 

Please see below documentation;

https://docs.splunk.com/Documentation/ES/6.4.1/Install/Indexes 

[lkutch_splunk]

Added this advice to https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Troubleshootnotables 🙂 

[kanam]

Thank you for support.

As you say, one indexer doesn't have notable index.

But this one was added after.

Can I install some apps needed to use ES manually?

[kanam]

I found procedure to install Splunk-TA-ForIndexer and installed.

Then both Indexer have notable index.

However notable event isn't created.