Splunk Enterprise Security

Status Changing on Old Notable Events

skippycat
Engager

When we create new alerts for testing, we have the correlation search create the notable event with a status of "Testing". This way, any alerts that fire go into Incident Review with a status of "Testing".

The problem is, when we are ready to move them out of testing, we change the notable event configuration to have a status of "New". But when we change that configuration, it changes all of the old notable events that fired with a "Testing" status to "New" which throws off metrics because suddenly there's an influx of notable events that show up as being "New" even though they were previously in status "Testing."

Is there a way to change the default status for notable events and have it NOT change the old ones that previously fired with the old default status?

Labels (1)
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...