Splunk Enterprise Security

Risk based alerting - Contributing Risk Events Drilldown not working?

torstein1
Explorer

Hi,

I have problems with the drilldown button in the "Risk Event Timeline" view for an Risk Notable.

When expanding Risk rules in the "Risk Event Timeline" view, you can click on a drilldown field named "Contributing events: View contribting events".

This button is disabled with the following message: "View contributing events" link is disabled as there is no drilldown search available for this risk rule.

The Risk rule is configured as a notable and has a drilldown search. 

Does anybody know how to enabled the drilldownsearch in the "Risk Event Timeline" view

 

Labels (1)
1 Solution

torstein1
Explorer

Temporary Solution:
Try setting static values to the following parameters:
action.notable.param.drilldown_earliest_offset
action.notable.param.drilldown_latest_offset.

By doing this it was possible to click the "View contributing events" link.

View solution in original post

chromefinch
Loves-to-Learn Lots

I added the following to the end of the drill down and made sure the time range was at least the same as the notable run time:
| eval drilldown_latest=_time + 3600
| eval drilldown_earliest=_time - 90000

you also need to make sure you have no mv fields 

0 Karma

torstein1
Explorer

Temporary Solution:
Try setting static values to the following parameters:
action.notable.param.drilldown_earliest_offset
action.notable.param.drilldown_latest_offset.

By doing this it was possible to click the "View contributing events" link.

mbjerkeland_spl
Splunk Employee
Splunk Employee

Since it seems to me that this isn't currently available I have created an idea on Splunk Ideas. I would appreciate it if you could give it your votes: https://ideas.splunk.com/ideas/ESSID-I-256

sidoyle_
Explorer

I have the exact same issue, something i have brought up with a couple of contacts within Splunk but have never had an answer on this.

Hopefully your post will get more traction and we get answer.

 

Simon

0 Karma

torstein1
Explorer

The drilldown button is mentioned in step 7 in this article:
Triage notables on Incident Review in Splunk Enterprise Security - Splunk Documentation

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...