Splunk Enterprise Security

SPLUNK ES Notable Event Closure

thambisetty
Super Champion

When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available

  • Status
  • Change urgency
  • Owner
  • Description Summary/Notes

Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.

  • Status
  • Change urgency
  • Owner
  • Category
  • Description Summary/Notes
————————————
If this helps, give a like below.
Labels (1)

thambisetty
Super Champion

answers are not related to question. I think this is the problem after migration from answers.splunk.com to community.splunk.com 

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

Your upgrade path will not be direct. You will need to upgrade ES to version 5 before installing ES 6. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_... for the path to upgrade ES.

Be sure to run the Splunk Platform Readiness app (https://splunkbase.splunk.com/app/4698/) before installing Splunk 8 to make sure all of your Python scripts will be compatible.

---
If this reply helps you, Karma would be appreciated.

thambisetty
Super Champion

Thanks @richgalloway for quick response.

Yes I understand my upgrade path is not direct.

The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or

First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.

I am now confused what to upgrade first.

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

ES can run on an unsupported version of Splunk for a short time. "Short" means "until we upgrade again later today".

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...