Splunk Search

How to write a search to display a Notable Event Timeline Review showing various phases of a ticket?

New Member

Hello everyone

Can anyone suggest me a search where I can get the notable Event time review between various phases of a ticket like Unassigned, in Progress, pending, resolved, and closed?

It should be like a table with a row of all notable event titles, column as status, and filling the table will be timestamps for all the statuses entered.

Any suggestions to get this kind of result?

Gaurav Chauhan

Labels (1)
0 Karma

Splunk Employee
Splunk Employee

This may not be an exact fit but might get you on the way

|`incident_review`  | rename status_label as status |stats values(rule_name), values(status), values(_time) by rule_id |rename values(_time) AS time

This would group the rule_id which is the key piece of grouping a notable event, bringing along the name of the correlation search and then grouping the status and pulling in the time for each status being reached.

This would only cover events that have changed status from unassigned because they are pulling from the audit index to get the changes in review state.
index=_audit sourcetype="incident_review"

To get all of the other notable events that are unassigned, you could do something like this:

|`es_notable_events` |where status = 1 |table rule_name, status_group, _time |`hourDiff(_time)`

This would give you all notable events that are in unassigned status and output the rule name, the time the event occurred and if you wanted to look at how many hours it has been while it is still unassigned you could use the macro hourDiff.

From there, you could do these as sub searches and use appendcols to pull it together.

This probably doesn't fully answer your question in the exact format you want but hopefully it is a step in the right direction.

BTW, incident_review and es_notable_events are macros. For some reason, it does not want to render correctly.


Splunk Employee
Splunk Employee

This has it shows half of the answer.

You should use the notable macro
notable | timechart count by rule_name


0 Karma

New Member

43 views and nobody answering, do i need to need to address to anyone specific

0 Karma


Do you have some sample events to work with? Furthermore, do you already have any field extractions on/from the events?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...