Having an issue within Splunk ES Incident Review.
The option to suppress events from most correlation searches works fine. A handful of events
do NOT offer the option to suppress.
The offending non-suppressible events are a consequence of the same few correlation searches. No other commonalities exist, as far as I'm able to tell. My user context has full rights to the instance, so I'm stumped.
It appears this article may help you. The section labeled "Suppress notable events from new correlation searches" appears to have the answer to your question.
Do you happen to know which correlation searches this happens with? It might be that they are missing the workflow actions to allow you to suppress them. I can verify if that is the case.