Splunk Enterprise Security

Search by id does not work in Incident Review

rbenbenish
New Member

When running a search on the Incident Review dashboard where the search term is the <event_id> value or event_id="<event_id>", there are no results.
It used to work in the past, and in one of the last updates, it stopped working.
I am using Enterprise Security version 7.3.2

Labels (2)
0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...