Splunk Enterprise Security

Splunk Notable Events not showing default owner



Hope you are  doing well!

I have updated exiting correlation alert in Splunk as  notable event which previously used to send email notification to 'x'. I have selected 'Default Owner' as 'leave as system default' (i.e. unassigned) but still when it trigger alerts in Splunk - Incident Review page, it showing owner as 'x'  (same as email owner) not as default owner i.e. unassigned.


Can someone help me with this?


Thanks in advance!

Labels (2)
0 Karma


Temporally, fixed this issue by hardcoding the parameters as per the screenshot but still the actual reason why it wasn't showing default parameters is unknown.  



0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...