Splunk Enterprise Security

Tokens in notable event titles and descriptions not getting expanded to include the values of the tokens on the Incident

VasukiPramod
Explorer


Tokens in notable event titles and descriptions not getting expanded to include the values of the tokens on the Incident Review dashboard, though the search Time extractions does exists in the notable event

Example:-

My Notable Event Title Contains the following text

Suspicious activity detected from User $UserId$

Expected Output for Title in Incident Review Dashboard

Suspicious activity detected from User XYZ

How the Title Column gets displayed in Incident Review dashboard

Suspicious activity detected from User $UserId$

However, the extractions does work for built-in extractions or fields like sourcetype etc.  Tokens work with few extractions, and not with few even though both of the search time extractions does exists in the notable events

Labels (2)
0 Karma

SONY_anilyelmar
Explorer

We faced same and got fixed with ES 6.6.1 +hot fix splunk provided

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls ensure the underlying correlation search returns a valid value for UserId, as this will be used in the Incident review screen.

0 Karma

VasukiPramod
Explorer

Yes........... We do get valid result when we run the search (correlation search) in Splunk, only Incident Review dashboard does have challenge to expand the token values

Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

Where in Incident Review dashboard, do you see the issue? In title, description, notable?  Generally all these should work with $fieldname$.  If its in the Incident review field values pane, then ensure the field is available as described in https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Customizenotables 

Hope this helps.

0 Karma

VasukiPramod
Explorer

The issue is seen within Tilte (rule_title) and Description fields of Incident Review dashboard... the notable event does have all the data expanded properly

0 Karma

lakshman239
SplunkTrust
SplunkTrust

What's your ES version and Splunk enterprise version.? I have n't seen this issue in ES 5.3.1, 6.x. You may also want to raise a case with support, if its only occurring on specific version.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...