Splunk IT Service Intelligence

IT Service Intelligence: How to get acknowledged notable events?

sboogaar
Path Finder

Is it possible to get a list with itsi acknowledged events?
I tried to get it based on the status like:

index=itsi_tracked_alerts status=2

But I get no results, however when I try:

index=itsi_notable_audit acknowledged

I will get events like:

{ [-]
activity: admin acknowledged notable event group
activity_type: Notable Event Group Update
event_id: 0cb32c45-2203-40e7-884c-73301b9da1e2

user: admin } Show as raw text
But the event_id is specific for the acknowledge action so I can not relate it to which event is acknowledged.
What I want to do is send an email with the acknowledged events (and the event description) when an event is acknowledged. Therefore im trying to make a savedsearch that gets all acknowledged events.

0 Karma
1 Solution

sboogaar
Path Finder

I solved it using:

index=itsi_notable_audit acknowledged 
| join event_id 
    [| inputlookup itsi_notable_event_group_lookup 
    | rename _key as event_id] 
| join event_id 
    [ search index=itsi_grouped_alerts 
    | rename itsi_group_id as event_id ] 
| table activity, itsi_group_description, _time

View solution in original post

0 Karma

sboogaar
Path Finder

I solved it using:

index=itsi_notable_audit acknowledged 
| join event_id 
    [| inputlookup itsi_notable_event_group_lookup 
    | rename _key as event_id] 
| join event_id 
    [ search index=itsi_grouped_alerts 
    | rename itsi_group_id as event_id ] 
| table activity, itsi_group_description, _time
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...