Splunk Enterprise Security

Splunk Enterprise Security: Is there a way to get detailed reporting of Investigations?

jongui
New Member

We use the Investigations as part of our case management process. With that said, is there any way to get data on investigations? We would like to get data such as but not limited to:

  • Count of Investigations by created by
  • Count of Investigations by status
  • Timechart of Investigations

Notable events are easily found in the notable index but we are unable to find the data on investigations to provide us the metrics.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...