I assign a TAG to event_id (notable event) in the Incident Review.
My question is, How to search all the notable event that I tag with value e.g. 'ABC' in the Splunk Search menu, instead of using Tag filter in the Incident review?
It is because I need to export to csv for management report.
If you run this search:
`notable` | search NOT `suppression` tag=<putyourtaghere>
Where you just replace with the name of your tag. For example I tagged one of my notables with KCHAMP so I used the following:
`notable` | search NOT `suppression` tag=KCHAMP
Let me know if this works for you. If you need to search across multiple tags, simply use an OR statement such as (tag=mytag1 OR tag=mytag2) etc.