When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available
Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.
answers are not related to question. I think this is the problem after migration from answers.splunk.com to community.splunk.com
Your upgrade path will not be direct. You will need to upgrade ES to version 5 before installing ES 6. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_... for the path to upgrade ES.
Be sure to run the Splunk Platform Readiness app (https://splunkbase.splunk.com/app/4698/) before installing Splunk 8 to make sure all of your Python scripts will be compatible.
Thanks @richgalloway for quick response.
Yes I understand my upgrade path is not direct.
The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or
First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.
I am now confused what to upgrade first.
ES can run on an unsupported version of Splunk for a short time. "Short" means "until we upgrade again later today".