Splunk ES - how to present all alerts with the feature "notable" enabled?

[BestestCohen]

Hi all.

I have recently started working on my workplace's Splunk and I got a request - to display all alerts that has the "notable" feature turned on.

I tried google it and came across to a close answer with "index=notable" but it's not enough because I want to get all alerts, not only those which got triggered and got notabled.

Thanks in advance.

[paulcurry]

This search will list out your correlation searches and what action is associated with each (risk/notable).

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",") | table title,actions

[BestestCohen]

Is it possible for an alert with "notable" enabled on it to not considered as correlation search? 

[paulcurry]

Not that I know of.  You can manually create a notable event from any indexed search using "Event Actions" but I think you are looking not just for the actual events but just the Adaptive Action enabled.