SPLUNK ES Notable Event Closure

[thambisetty]

When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available

• Status
• Change urgency
• Owner
• Description Summary/Notes

Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.

• Status
• Change urgency
• Owner
• Category
• Description Summary/Notes

[thambisetty]

answers are not related to question. I think this is the problem after migration from answers.splunk.com to community.splunk.com 

[richgalloway]

Your upgrade path will not be direct. You will need to upgrade ES to version 5 before installing ES 6. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_... for the path to upgrade ES.

Be sure to run the Splunk Platform Readiness app (https://splunkbase.splunk.com/app/4698/) before installing Splunk 8 to make sure all of your Python scripts will be compatible.

[thambisetty]

Thanks @richgalloway for quick response.

Yes I understand my upgrade path is not direct.

The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or

First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.

I am now confused what to upgrade first.

[richgalloway]

ES can run on an unsupported version of Splunk for a short time. "Short" means "until we upgrade again later today".