Splunk Search

How to write a Query to identify Splunk notable rule triggers with change in urgency?

Manoj8888
Engager

Hello,

 

I am trying write a query to  identify if any Splunk notable rule triggers with change in Urgency (i.e. from medium to high).Cloud any one please  help me in building  the query?

Labels (1)
0 Karma

smurf
Communicator

Hi,

When any Urgency is selected when editing a Notable (even if it is the same as the original Urgency) can be found like this:

index=_audit source=notable_update_rest_handler urgency=*

 

Originally, I thought you were looking for a Notable that has a different Urgency than what you defined in Severity in the correlation search. That could be found like this:

`notable` | where severity != urgency 

 

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...