Splunk Enterprise Security

SPLUNK ES Notable Event Closure

thambisetty
SplunkTrust
SplunkTrust

When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available

  • Status
  • Change urgency
  • Owner
  • Description Summary/Notes

Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.

  • Status
  • Change urgency
  • Owner
  • Category
  • Description Summary/Notes
————————————
If this helps, give a like below.
Labels (1)

thambisetty
SplunkTrust
SplunkTrust

answers are not related to question. I think this is the problem after migration from answers.splunk.com to community.splunk.com 

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

Your upgrade path will not be direct. You will need to upgrade ES to version 5 before installing ES 6. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_... for the path to upgrade ES.

Be sure to run the Splunk Platform Readiness app (https://splunkbase.splunk.com/app/4698/) before installing Splunk 8 to make sure all of your Python scripts will be compatible.

---
If this reply helps you, Karma would be appreciated.

thambisetty
SplunkTrust
SplunkTrust

Thanks @richgalloway for quick response.

Yes I understand my upgrade path is not direct.

The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or

First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.

I am now confused what to upgrade first.

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

ES can run on an unsupported version of Splunk for a short time. "Short" means "until we upgrade again later today".

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...