Quick question about Splunk ES:
On version 4.7.4 I am curious if there was a way to do this. On Investigations, we are going to add a new Investigation Journal/Investigation. Is there a way to populate the name field with a custom nomenclature? We wanted to generate Investigation names programmatically where possible to keep things consistent, like adding the date/custom character set each time or iterate by 1 or some interval to ensure names are correct.
If there's something in a .conf file to adjust or if it's just not currently possible, any advice is helpful. Thanks!
