Splunk Enterprise Security: Why are the colored icons missing from the urgency field when manually setting urgency with eval?

[miront]

I want to combine multiple notable events into a single search so I am using this: eval urgency=case(infection_count<=1, "Low", infection_count>1 AND infection_count<=5, "Medium", infection_count>5 AND infection_count<=10, "High") to manually set urgency. When I do this, the Red/Yellow/Green/Blue icons that typically accompany the urgency are missing. In the attached screenshot you will see one that has the yellow icon. This was achieved by manually setting the urgency via the dropdown on the incident review dashboard. The rest are missing. Any ideas?

[dflodstrom]

To solve this issue I used the lower case values in my eval. So in your case try: eval urgency=case(infection_count<=1, "low", infection_count>1 AND infection_count<=5, "medium", infection_count>5 AND infection_count<=10, "high")

[smoir_splunk]

@miront, are there any console log errors?