We have our Splunk - Resilient integration mostly working and wanted to add a script in Resilient to update the status of Notables. It seems that not all of the notable events we are sending to Resilient contain a notable event_id.
We used the following search to send events (every 5 minutes):
`notable` | where isnull(notable_xref)
It looked like maybe we were picking up the Short Id being modified, so I did try this:
`notable`| where NOT like (notable_xref_name, "resilient%")
Still no joy, some events passed to Resilient do not contain the event_id, even though everything seems to work properly and I see the event_id in the notable events in Splunk - even though it didn't make it to Resilient.
Any tips on further troubleshooting?
