Splunk Enterprise Security

Splunk Enterprise Security: How to manually trigger notables?

koshyk
Super Champion

We had an outage of 2 hours for all Enterprise Security Search Heads. During this period, we missed few notables to "Incident View" screen. Of-course when Splunk came back-up it started cron jobs from that point onwards and the 2 hours worth of notables is not triggered.
(THese notables are generated using savedsearches within Enterprise Security)
So my query
- if I know the time period and savedsearches/co-relation search for Use-case. How to trigger notables to "Incident Review" dashboard manually?

The only piece I don't know is search to notables index insertion. If you guys know the summary-indexing search to notables , it would be very helpful

0 Karma

wenthold
Communicator

If you search for the events manually under the Splunk Enterprise Security search context (ES->Search->Search), "Create Notable Event" will be one of the options available from the "Event Actions" drop down in the search results.

AFAIK, this will only work with raw search results. I don't believe you can manually create notables from tstats/stats/etc. results.

0 Karma

koshyk
Super Champion

I've almost found a way to create notables from tstats. just testing few more notables and duplicates to validate this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...