Splunk Enterprise Security
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

Where does the information related to Splunk Investigation get store in Splunk ?

payal_4296
New Member
‎12-18-2023 10:08 AM

Where is the data from the Splunk Enterprise Security (ES) Investigation Panel stored?
In the previous version, it seemed to be stored in a KV lookup, but I can't find it in the current 7.x version.

I understand that the Notable index holds information related to incidents from the Incident Review Dashboard.
How can we map Splunk Notables and their Investigations together to generate a comprehensive report in the current 7.x ES version?

Labels (2)
0 Karma
Reply
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...