Splunk ITSI

How can we extract a list of open episodes in splunk itsi?

ManjunathN
Engager

Hi,

How can we extract a list of open episodes in splunk itsi.Please 

Thanks!

Labels (1)
0 Karma

skramp
SplunkTrust
SplunkTrust

This post is old but unanswered. I did it this way: 

index=itsi_grouped_alerts 
| lookup itsi_notable_group_user_lookup event_identifier_hash as itsi_group_id 
| search status=1
0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...