Splunk Enterprise Security

Search notable event with TAG value



I assign a TAG to event_id (notable event) in the Incident Review.

My question is, How to search all the notable event that I tag with value e.g. 'ABC' in the Splunk Search menu, instead of using Tag filter in the Incident review?

It is because I need to export to csv for management report.


0 Karma

Splunk Employee
Splunk Employee

If you run this search:

`notable` | search NOT `suppression` tag=<putyourtaghere>

Where you just replace with the name of your tag. For example I tagged one of my notables with KCHAMP so I used the following:

`notable` | search NOT `suppression` tag=KCHAMP

Let me know if this works for you. If you need to search across multiple tags, simply use an OR statement such as (tag=mytag1 OR tag=mytag2) etc.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!