Splunk Enterprise Security

Splunk Enterprise Security: How to manually trigger notables?

koshyk
Super Champion

We had an outage of 2 hours for all Enterprise Security Search Heads. During this period, we missed few notables to "Incident View" screen. Of-course when Splunk came back-up it started cron jobs from that point onwards and the 2 hours worth of notables is not triggered.
(THese notables are generated using savedsearches within Enterprise Security)
So my query
- if I know the time period and savedsearches/co-relation search for Use-case. How to trigger notables to "Incident Review" dashboard manually?

The only piece I don't know is search to notables index insertion. If you guys know the summary-indexing search to notables , it would be very helpful

0 Karma

wenthold
Communicator

If you search for the events manually under the Splunk Enterprise Security search context (ES->Search->Search), "Create Notable Event" will be one of the options available from the "Event Actions" drop down in the search results.

AFAIK, this will only work with raw search results. I don't believe you can manually create notables from tstats/stats/etc. results.

0 Karma

koshyk
Super Champion

I've almost found a way to create notables from tstats. just testing few more notables and duplicates to validate this.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...