Splunk Search

How to write a Query to identify Splunk notable rule triggers with change in urgency?

Manoj8888
Engager

Hello,

 

I am trying write a query to  identify if any Splunk notable rule triggers with change in Urgency (i.e. from medium to high).Cloud any one please  help me in building  the query?

Labels (1)
0 Karma

smurf
Communicator

Hi,

When any Urgency is selected when editing a Notable (even if it is the same as the original Urgency) can be found like this:

index=_audit source=notable_update_rest_handler urgency=*

 

Originally, I thought you were looking for a Notable that has a different Urgency than what you defined in Severity in the correlation search. That could be found like this:

`notable` | where severity != urgency 

 

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...