How to write a Query to identify Splunk notable rule triggers with change in urgency?

[Manoj8888]

Hello,

I am trying write a query to  identify if any Splunk notable rule triggers with change in Urgency (i.e. from medium to high).Cloud any one please  help me in building  the query?

[smurf]

Hi,

When any Urgency is selected when editing a Notable (even if it is the same as the original Urgency) can be found like this:

index=_audit source=notable_update_rest_handler urgency=*

Originally, I thought you were looking for a Notable that has a different Urgency than what you defined in Severity in the correlation search. That could be found like this:

`notable` | where severity != urgency