Splunk Search

How do you add notes for events?

dokaas_2
Communicator

I'm looking for a way to use a modal form to add comments to events. The behavior would be to click on an event, have a modal form displayed with a textfield box, the user adds their comments, and then posts the comments to a Splunk index.

The modal form isn't too much of a problem, I don't know how to get the information into Splunk (REST API maybe)?

0 Karma

woodcock
Esteemed Legend

Splunk's product stores this kind of thing in a KV Store collection but you could also store it into a Summary Index using | collect.

Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...