Thanks David. That's what I am looking for. But the only issue is these capabilities don't track incident deletion. If an incident gets deleted, It's no longer available in the "Incident Review" dashboard or the lookup table. I am trying to find a way to report on those that gets deleted. ... View more

Hi David, Additional clarification - By ticket/case/investigation I am referring to Splunk notable events that are actively open and being investigated. Thanks! ... View more

Hi David, Thanks for your response. I am not targeting any data source specifically, I am looking to get a daily report Splunk incident/case/investigation that've been deleted by any authorized Splunk users. I hope that helps clarify the question. Thanks! ... View more