Splunk Search

Entering comments into a notable event - possible?

shiftey
Path Finder

Hi Splunk Answers,

I understand that notable events can be assigned severity as well as being assigned to different analysts.

Is it possible to update an event with comments. This would be useful so the analyst working on the event can enter useful information before assigning to another analyst.

Thanks

0 Karma

LukeMurphey
Champion

You do this by entering by editing the event and entering only a comment. Leave the other fields empty and it not change those items (will leave the status, urgency and owner unchanged).

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...