Splunk Enterprise Security

SPLUNK ES Notable Event Closure

thambisetty
SplunkTrust
SplunkTrust

When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available

  • Status
  • Change urgency
  • Owner
  • Description Summary/Notes

Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.

  • Status
  • Change urgency
  • Owner
  • Category
  • Description Summary/Notes
————————————
If this helps, give a like below.
Labels (1)

thambisetty
SplunkTrust
SplunkTrust

answers are not related to question. I think this is the problem after migration from answers.splunk.com to community.splunk.com 

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

Your upgrade path will not be direct. You will need to upgrade ES to version 5 before installing ES 6. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_... for the path to upgrade ES.

Be sure to run the Splunk Platform Readiness app (https://splunkbase.splunk.com/app/4698/) before installing Splunk 8 to make sure all of your Python scripts will be compatible.

---
If this reply helps you, Karma would be appreciated.

thambisetty
SplunkTrust
SplunkTrust

Thanks @richgalloway for quick response.

Yes I understand my upgrade path is not direct.

The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or

First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.

I am now confused what to upgrade first.

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

ES can run on an unsupported version of Splunk for a short time. "Short" means "until we upgrade again later today".

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...