Noteable Event Supression

[Rhidian]

Is it possible to use a lookup file in the Noteble Event supression say to look up a list of assets/enviroments that we do/don't want to know about?

[inventsekar]

Last month we were working on a Splunk ES Demo and i found out that we can not delete a notable.

either i have not understood the ES yet or the ES developers are really funny, lol ! 

[bowesmana · Accepted solution]

When you talk about Notable event suppression, I assume you are talking about the Notable Event Suppression action in the Incident Review.

If you want to whitelist/blacklist certain assets, then you should add the lookup logic to the correlation search that has caused the notable event in the first place.

You cannot add lookup logic to the event type search ES creates for the suppression logic.

[Rhidian]

Thanks, I wanted to avid that as I would need to updated a lot of correlation searches.  Any idea why this isn'g possible as the search looks like standard SPL?

[bowesmana]

Unfortunately event type searches cannot contain any pipelines, so it has to be simply a raw search fragment