Is there a way to set the starting/minimum ID for Events/Cases?

[wstutzman]

Hello,

We're coming from another platform that we used to keep track of incidents.  In order to keep things more consistent after the transition, we'd like to be able to have the IDs of new cases start at a higher number than the default of 1, if possible.  Is this something that can be done?

I haven't seen anything in the settings or documentation.

Thanks!

[phanTom · Accepted solution]

@wstutzman unfortunately the only way to do this would be to generate the number of containers needed to meet the number parity of the other platform. You can create and then delete all using REST: https://docs.splunk.com/Documentation/SOARonprem/5.3.5/PlatformAPI/RESTContainers 

-- If this solved the issue please mark as the solution! Happy SOARing --