Splunk Enterprise Security

SPLUNK ES Notable Event Closure

thambisetty
Super Champion

When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available

  • Status
  • Change urgency
  • Owner
  • Description Summary/Notes

Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.

  • Status
  • Change urgency
  • Owner
  • Category
  • Description Summary/Notes
————————————
If this helps, give a like below.
Labels (1)

thambisetty
Super Champion

answers are not related to question. I think this is the problem after migration from answers.splunk.com to community.splunk.com 

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

Your upgrade path will not be direct. You will need to upgrade ES to version 5 before installing ES 6. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/HowtoupgradeSplunk#Upgrade_paths_to_... for the path to upgrade ES.

Be sure to run the Splunk Platform Readiness app (https://splunkbase.splunk.com/app/4698/) before installing Splunk 8 to make sure all of your Python scripts will be compatible.

---
If this reply helps you, an upvote would be appreciated.

thambisetty
Super Champion

Thanks @richgalloway for quick response.

Yes I understand my upgrade path is not direct.

The problem is first if I upgrade Splunk ES to 5.x it doesn’t support Current version of Enterprise or

First If I upgrade Splunk Enterprise to lets say 7.3.3 Then ES current version doesn’t support.

I am now confused what to upgrade first.

————————————
If this helps, give a like below.

richgalloway
SplunkTrust
SplunkTrust

ES can run on an unsupported version of Splunk for a short time. "Short" means "until we upgrade again later today".

---
If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!