Splunk Enterprise Security

Search notable event with TAG value



I assign a TAG to event_id (notable event) in the Incident Review.

My question is, How to search all the notable event that I tag with value e.g. 'ABC' in the Splunk Search menu, instead of using Tag filter in the Incident review?

It is because I need to export to csv for management report.


0 Karma

Splunk Employee
Splunk Employee

If you run this search:

`notable` | search NOT `suppression` tag=<putyourtaghere>

Where you just replace with the name of your tag. For example I tagged one of my notables with KCHAMP so I used the following:

`notable` | search NOT `suppression` tag=KCHAMP

Let me know if this works for you. If you need to search across multiple tags, simply use an OR statement such as (tag=mytag1 OR tag=mytag2) etc.

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...