Null value for urgency in incident_review lookup

[evelenke]

Hi Splunkers,

when we save\close notable events without changing the Urgency we get no any value (null) for urgency in incident_review_lookup.
In ES Incident Review view the Urgency is shown and just has initial value (as expected).
Is it possible to get the default value for urgency in lookup in case we want to leave urgency as is?

[nswondem]

One of my customers had this situation before and it turned out that the severity was being assigned an unknown value in the correlation search. Take a look at the ES documentation for determining urgency.

https://docs.splunk.com/Documentation/ES/5.3.1/User/Howurgencyisassigned

In the customer's case, the assigned priority was being overwritten in the correlation search. It was being set to a value that was not in the blue or gold sections of the urgency table (see link).

So for example ES expects the Assigned Priority to be Unknown, Low, Medium, High, or Critical. If your correlation search mistakenly sets a field called priority to Informational then ES cannot correctly calculate the urgency. You will get a NULL value.