Splunk Enterprise Security
Highlighted

Splunk Enterprise Security: Why are the colored icons missing from the urgency field when manually setting urgency with eval?

Explorer

I want to combine multiple notable events into a single search so I am using this: eval urgency=case(infection_count<=1, "Low", infection_count>1 AND infection_count<=5, "Medium", infection_count>5 AND infection_count<=10, "High") to manually set urgency. When I do this, the Red/Yellow/Green/Blue icons that typically accompany the urgency are missing. In the attached screenshot you will see one that has the yellow icon. This was achieved by manually setting the urgency via the dropdown on the incident review dashboard. The rest are missing. Any ideas?

alt text

Highlighted

Re: Splunk Enterprise Security: Why are the colored icons missing from the urgency field when manually setting urgency with eval?

Splunk Employee
Splunk Employee

@miront, are there any console log errors?

0 Karma
Highlighted

Re: Splunk Enterprise Security: Why are the colored icons missing from the urgency field when manually setting urgency with eval?

Builder

To solve this issue I used the lower case values in my eval. So in your case try: eval urgency=case(infection_count<=1, "low", infection_count>1 AND infection_count<=5, "medium", infection_count>5 AND infection_count<=10, "high")

0 Karma